SQL Injection - Stored Procedures

[curea]

Add additional SQL injection rules for .sql files (additional files):

Look for sp_executesql without the 2, 3 parameters or EXEC statement.

Find all where one of these methods is called using a string data w/ no parms. Plus, go a step back and make sure a string variable is appended into the statement.

https://msdn.microsoft.com/en-us/library/bb399403(v=vs.110).aspx