SEC002
SQL via string concatenation
Object Pascal — Delphi & Free Pascal
Warning
Security
Concatenation is a common SQL injection precursor
concatenation is a common SQL injection precursor.
Why this severity
concatenation is a common SQL injection precursor.
Known false positives
internal-only tooling with fully constant query fragments.
Remediation example
Query.SQL.Text := 'select * from users where id = :id';
Query.ParamByName('id').AsInteger := UserId;