Zennoxa Shield
Rules / C#
SHIELD-CSHARP-001

SQL injection via string concatenation in SqlCommand

criticalC#CWE-89CVSS 9.8

What it detects

A SqlCommand is built by concatenating untrusted strings directly into the query text.

How to fix

Use parameterized queries with SqlParameter instead of concatenating values into the SQL string.

Vulnerable — Shield flags thisUserStore.cs
using System.Data.SqlClient;

public class UserStore
{
    public SqlCommand FindUser(SqlConnection conn, string name)
    {
        // user input concatenated straight into the query text
        return new SqlCommand("SELECT * FROM Users WHERE Name = '" + name + "'", conn);
    }
}
Fixed — scans cleanUserStore.cs
using System.Data.SqlClient;

public class UserStore
{
    public SqlCommand FindUser(SqlConnection conn, string name)
    {
        var cmd = new SqlCommand("SELECT * FROM Users WHERE Name = @name", conn);
        cmd.Parameters.AddWithValue("@name", name);
        return cmd;
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-001: SQL injection via string concatenation in SqlCommand — Zennoxa Shield