Sql injection (ARCH302)

Key dotnet.security.sql-injection · Severity error · Category security · CWE CWE-89

Concatenating user input directly into SQL text lets an attacker alter the query. Parameters separate data from code.

Incorrect

var cmd = new SqlCommand(
    "SELECT * FROM Users WHERE Name = '" + name + "'", conn);
var reader = cmd.ExecuteReader();

Correct

var cmd = new SqlCommand(
    "SELECT * FROM Users WHERE Name = @name", conn);
cmd.Parameters.AddWithValue("@name", name);
var reader = cmd.ExecuteReader();

Fix

Use parameterized commands or an ORM for all variable input; never build SQL with string concatenation or interpolation.