Description

Detects SQL injection vulnerabilities in C# code where SqlCommand objects are used with potentially untrusted data in query strings. This can allow attackers to manipulate SQL queries through user input, potentially leading to unauthorized database access or manipulation.

Detection Strategy

• Identifies instantiations of SqlCommand objects in C# code

• Checks if the SQL query string used in the SqlCommand contains user-controlled or untrusted input

• Analyzes data flow to determine if query parameters come from user-controlled sources like request parameters or form data

• Reports a vulnerability when a SqlCommand is constructed with a query string that includes unvalidated user input

Vulnerable code example

using System.Data.SqlClient;

public class UserViewer
{
    public void GetUserData(string userId)
    {
        using (SqlConnection conn = new SqlConnection("connection_string"))
        {...

✅ Secure code example

using System.Data.SqlClient;

public class UserViewer
{
    public void GetUserData(string userId)
    {
        using (SqlConnection conn = new SqlConnection("connection_string"))
        {...