Rule Definition
The software constructs all or part of an SQL command via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the SQL command may be completely altered.

Remediation
Use authorized sanitization methods.

Violation Code Sample

...
String userId = {get data from API request}; 
String sqlQuery = "select * from users where userId = " + userId;
...
ResultSet rs = stmt.executeQuery(sqlQuery);
...

Fixed Code Sample

...
String userId = {get data API request}; 
String sqlQuery = "select * from users where userId = ?";
...
stmt.setString(1, userId);
ResultSet rs = stmt.executeQuery(sqlQuery);
...

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') https://cwe.mitre.org/data/definitions/89.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection CISQ rule: ASCSM-CWE-89.