Study. uk . com
  1. Home
  2. All questions
  3. Question 141

CompTIA Security+ study material · question 141 of 611

A team moves all queries into stored procedures and declares SQL injection solved. Under what condition is that claim wrong?

  1. If the procedures return more than one result set
  2. If the procedures build dynamic SQL from their parameters
  3. If the procedures are called from more than one application
  4. If the database account has read-only access
Show the answer

Answer: B. If the procedures build dynamic SQL from their parameters

A stored procedure that concatenates strings is exactly as vulnerable as inline SQL doing the same thing.

Source: OWASP SQL Injection Prevention Cheat Sheet (OWASP) — OWASP SQL Injection Prevention Cheat Sheet › Defense Option 2

Challenge yourself on this topic → Study as cards