Study. uk . com
  1. Home
  2. All questions
  3. Question 467

CISSP study material · question 467 of 500

A developer argues that moving all database access into stored procedures removes injection risk. Under what condition does OWASP say a stored procedure can still be injectable?

  1. Where its own code concatenates query text with data or executes constructed statements dynamically.
  2. Where the calling application does not validate the procedure's name.
  3. Where it is invoked over a connection that is not encrypted.
  4. Where it returns more rows than the caller requested.
Show the answer

Answer: A. Where its own code concatenates query text with data or executes constructed statements dynamically.

OWASP notes that even when parameterised, stored procedures can still introduce injection if the procedure language concatenates queries and data or executes hostile data dynamically.

Source: OWASP Top 10 A05:2025 (OWASP) — OWASP Top 10:2025 A05 Injection > How to prevent

Challenge yourself on this topic → Study as cards