What is the difference between using EXEC and calling a stored procedure through parameterized application code, and why does this distinction matter for security?

Calling a stored procedure properly through parameterized application code passes user input as distinct parameters that SQL Server treats strictly as data, while carelessly using EXEC to build and run a dynamic string that includes concatenated user input can expose your application to SQL injection if that input is not properly validated and escaped first.

-- Safe: proper parameterized call
EXEC GetCustomerOrders @CustomerId = 123;

-- Risky if built from unsanitized user input
EXEC ('SELECT * FROM Orders WHERE CustomerId = ' + @UserInput);