Zennoxa Shield
Rules / C#
SHIELD-CSHARP-002

SQL injection via string.Format or interpolation into query

criticalC#CWE-89CVSS 9.8

What it detects

A SQL query is assembled with string.Format or an interpolated string that embeds untrusted values.

How to fix

Replace string.Format and interpolation with parameterized queries binding user input as SqlParameter values.

Vulnerable — Shield flags thisUserRepository.cs
using System.Data.SqlClient;

public class UserRepository
{
    public void FindUser(SqlConnection conn, string name)
    {
        var cmd = conn.CreateCommand();
        cmd.CommandText = string.Format("SELECT * FROM Users WHERE Name = '{0}'", name);
        using var reader = cmd.ExecuteReader();
    }
}
Fixed — scans cleanUserRepository.cs
using System.Data.SqlClient;

public class UserRepository
{
    public void FindUser(SqlConnection conn, string name)
    {
        var cmd = conn.CreateCommand();
        cmd.CommandText = "SELECT * FROM Users WHERE Name = @name";
        cmd.Parameters.AddWithValue("@name", name);
        using var reader = cmd.ExecuteReader();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-002: SQL injection via string.Format or interpolation into query — Zennoxa Shield