Poisoned Pipeline / Mitigations / M1171
M1171
Use stored procedures
A stored procedure is a set of Structured Query Language (SQL) statements with an assigned name, which are stored in a database, so it can be reused and shared by multiple applications.
A stored procedure provides an important layer of security between the user interface and the database.
It supports security through data access controls because end users may enter or change data, but do not write procedures.
A stored procedure preserves data integrity because information is entered in a consistent manner.
Note that safely implemented stored procedure does not include any unsafe dynamic SQL generation.
Applies to
- T0117 SQL injection