4 ms·
> doesn't allow SQL injection Here's an injection vulnerable stored proc call. string badSql = "exec fooProc " + arg; User input need to be parameterized
by foobarbaz33 3y ago
> doesn't allow SQL injection
Here's an injection vulnerable stored proc call.
string badSql = "exec fooProc " + arg;
User input need to be parameterized whether you are calling a stored proc or not.