CRITICAL
Rule Definition
Dynamic queries are difficult to test and can decrease the code understanding. Moreover, include dynamic coding in UI components can generate security issues if the content of the dynamic clauses is not filter properly.
Remediation
Avoid using dynamic coding as much as possible and check if dynamic content is filtered properly.
Violation Code Sample
select count(*) from (p_tab) into l_count.
select * from zcostfreq
where (where_tab).
endselect.
Reference
NetWeaver - Secure Programming - ABAP
http://help.sap.com/saphelp_nw2004s/helpdata/en/8f/35de1718944eb8a1462cf6362cc8b8/frameset.htm
Related Technologies
Technical Criterion
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.