Rule Definition
The software constructs all or part of an SQL command via user-controllable inputs (inputs coming from another database access). These inputs are not neutralized or are incorrectly neutralized. As a consequence, the SQL command may be completely altered.

Remediation
Use authorized sanitization methods.

Violation Code Sample

public function deleteUser(PDO $pdo, string $userName) : void {
    $pdo->exec("select user_id from users where user_name = " . $userName);
    $userId = self::getUserId();
    $pdo->exec("delete from users where user_id = " . $userId);  // VIOLATION
}

Fixed Code Sample

public function deleteUser(PDO $pdo, string $userName) : void {
    $pdo->exec("select user_id from users where user_name = " . $userName);
    $userId = self::getUserId();
    $userId = $pdo->quote($userId);
    $pdo->exec("delete from users where user_id = " . $userId);  // VIOLATION
}

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') https://cwe.mitre.org/data/definitions/89.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A1-Injection CISQ rule: ASCSM-CWE-89.