All rules →
Rules / C#
SHIELD-CSHARP-002

SQL injection via string.Format or interpolation into query

criticalC#CWE-89CVSS 9.8

What it detects

A SQL query is assembled with string.Format or an interpolated string that embeds untrusted values.

How to fix

Replace string.Format and interpolation with parameterized queries binding user input as SqlParameter values.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-002: SQL injection via string.Format or interpolation into query — Zennoxa Shield