Question

Is there a way to prevent sql injection by using stored procedures?

I have a sql query as

select column name from table where field ='@value'
cmd.parameters.add('@value', value);

I am using parameterized queries with least privileges. How can i write a basic stored procedure to prevent an sql injection. Is that possible?

Answer 1

 select column name from table where field =@value

 cmd.parameters.add('@value', value);

SQL Parameters avoid the sql injection problem.

You just need to change the = condition with parameter. check above query.