Vulnerability: SQL query built from user-controlled sources / alert number: 15

[SAIKARTHIKGOTURI]

Severity: High Vulnerability Description: SQL query built from user-controlled sources More Details: https://github.com/Karthiktests/demo-csharp/security/code-scanning/15 State: open Updated At: 2024-09-05T18:07:57Z Created At: 2024-09-05T18:07:56Z

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: Query built from user-controlled sources (Detected by phrase)

Matched on "query built from user-controlled sources"

What is this? (2min video)

Building a SQL or Java Persistence query from user-controlled sources is vulnerable to insertion of malicious code by the user.

Try a challenge in Secure Code Warrior

Helpful references

• PHP SQL Injection Page - A detailed page on SQL injection in the online PHP manual.
• OWASP SQL Injection Prevention Cheat Sheet - This article is focused on providing clear, simple, actionable guidance for preventing SQL Injection flaws in your applications.
• OWASP SQL Injection - OWASP community page with comprehensive information about SQL injection, and links to various OWASP resources to help detect or prevent it.
• OWASP Query Parameterization Cheat Sheet - A derivative work of the OWASP SQL Injection Prevention Cheat Sheet focused on SQL query parameterization.
• Preventing SQL Injection Attacks With Python - A tutorial on crafting parameterized queries, SQL composition and safe query execution in Python.

Micro-Learning Topic: SQL query built from user-controlled sources (Detected by phrase)

Matched on "SQL query built from user-controlled sources"

What is this? (2min video)

Building a SQL query from user-controlled sources is vulnerable to insertion of malicious SQL code by the user.

Try a challenge in Secure Code Warrior

Helpful references

• PHP SQL Injection Page - A detailed page on SQL injection in the online PHP manual.
• OWASP SQL Injection Prevention Cheat Sheet - This article is focused on providing clear, simple, actionable guidance for preventing SQL Injection flaws in your applications.
• OWASP SQL Injection - OWASP community page with comprehensive information about SQL injection, and links to various OWASP resources to help detect or prevent it.
• OWASP Query Parameterization Cheat Sheet - A derivative work of the OWASP SQL Injection Prevention Cheat Sheet focused on SQL query parameterization.
• Preventing SQL Injection Attacks With Python - A tutorial on crafting parameterized queries, SQL composition and safe query execution in Python.