>If you only use stored procs, you're a lot less exposed to SQL injections etc. How does that help you vs. prepared statements in any typical language? I've s

>If you only use stored procs, you're a lot less exposed to SQL injections etc. How does that help you vs. prepared statements in any typical language? I've seen SQL statements in SPs that are concatenated (|| in oracle) to varchar fields from a table and I thought that would be just as vulnerable?