Formatted SQL queries can be difficult to maintain, debug and can increase the risk of SQL injection when concatenating untrusted values into the query. However, this rule doesn’t detect SQL injections (unlike rule {rule:vbnet:S3649}), the goal is only to highlight complex/formatted queries.

Ask Yourself Whether

• Some parts of the query come from untrusted values (like user inputs).
• The query is repeated/duplicated in other parts of the code.
• The application must support different types of relational databases.

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

• Use parameterized queries, prepared statements, or stored procedures and bind variables to SQL query parameters.
• Consider using ORM frameworks if there is a need to have an abstract layer to access data.

Sensitive Code Example

Public Sub SqlCommands(ByVal connection As SqlConnection, ByVal query As String, ByVal param As String)
    Dim sensitiveQuery As String = String.Concat(query, param)
    command = New SqlCommand(sensitiveQuery) ' Sensitive

    command.CommandText = sensitiveQuery ' Sensitive

    Dim adapter As SqlDataAdapter
    adapter = New SqlDataAdapter(sensitiveQuery, connection) ' Sensitive
End Sub

Public Sub Foo(ByVal context As DbContext, ByVal query As String, ByVal param As String)
    Dim sensitiveQuery As String = String.Concat(query, param)
    context.Database.ExecuteSqlCommand(sensitiveQuery) ' Sensitive

    context.Query(Of User)().FromSql(sensitiveQuery) ' Sensitive
End Sub

Compliant Solution

Public Sub Foo(ByVal context As DbContext, ByVal value As String)
    context.Database.ExecuteSqlCommand("SELECT * FROM mytable WHERE mycol=@p0", value) ' Compliant, the query is parameterized
End Sub

See

• OWASP Top 10 2021 Category A3 - Injection
• OWASP Top 10 2017 Category A1 - Injection
• MITRE, CWE-20 - Improper Input Validation
• MITRE, CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
• SANS Top 25 - Insecure Interaction Between Components
• Derived from FindSecBugs rules Potential SQL/JPQL Injection (JPA), Potential SQL/JDOQL Injection (JDO), Potential SQL/HQL Injection (Hibernate)