formsof

问题 Is the following SQL susceptible to SQL injection via the @SearchWord parameter? I want to use parameters with the FormsOf function, but the only guide to doing so I've found is in this Stack Overflow question: How to pass parameter to FormsOf function in sql server However the solution seems to be to use a bit of dynamic SQL, and I was wondering if that would be susceptible to SQL injection. What would happen in the following example if @searchWord contained a SQL injection type string? Is

问题 I am new to SQL Server Full Text Searching, and am trying to figure out the best way to search on multiple words using the inflectional engine so the search uses the various forms of all of the words. From what I read, FREETEXT uses an implicit OR when used with multiple words. I want an AND so that the search results contain all of the words, so because of this I am choosing to use CONTAINS. I am trying to do something like the query below, which uses FORMSOF with the proximity keyword NEAR