If the web app is only allowed to run a few dozen stored procedures, then there are practically no attack vectors from an exploited website.
If it can run arbitrary queries, then you're going to have problems.