Rule Definition
The software constructs all or part of an SQL command via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the SQL command may be completely altered.

Remediation
Depending on the SQL Command style: for SQL Command in dynamic query (PHP) It is recommended to use prepared statements for all SQL queries. The prepared statement itself should only use placeholders for data and never concatenate data directly into the query. for SQL Command without quotes (PHP) No quotes are used around the detected injection point in the SQL query. Thus, all applied operations to escape the data are insufficient because no quotes have to be broken in order to inject SQL syntax. In case a numerical value is expected, a typecast operation should be performed on the user input. for SQL Command within single quotes (PHP) The detected injection point in the SQL query occurs within single quotes. Thus, the user input can be sanitized by using the built-in function addslashes() that escapes the data and prevents breaking out of the quotes.

Violation Code Sample

<?php

class A {
    public function deleteUser(PDO $pdo) : void {
        $userId = self::getUserId();
        $pdo->exec("delete from users where user_id = " . $userId);  // VIOLATION
    }

    public static function getUserId() : string {
        return (string) $_GET["user_id"];
    }
}

Fixed Code Sample

<?php

class A {

    public function deleteUser(PDO $pdo) : void {
        $userId = self::getUserId();
        $userId = $pdo->quote($userId);                              // ESCAPE SPECIAL CHARACTERS
        $pdo->exec("delete from users where user_id = " . $userId);  // FIXED
    }

    public static function getUserId() : string {
        return (string) $_GET["user_id"];
    }
}

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') https://cwe.mitre.org/data/definitions/89.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/ CISQ rule: ASCSM-CWE-89.