VB010
SQL via string concatenation
Visual Basic 6
Warning
Security
Concatenated SQL plus user input is injection; ADO with assembled WHERE clauses is the most common security hole in legacy VB6
concatenated SQL plus user input is injection; ADO with assembled WHERE clauses is the most common security hole in legacy VB6.
Why this severity
concatenated SQL plus user input is injection; ADO with assembled WHERE clauses is the most common security hole in legacy VB6.
Known false positives
fully constant queries assembled across lines for readability.
Remediation example
cmd.CommandText = "SELECT * FROM users WHERE name = ?" cmd.Parameters.Append cmd.CreateParameter(, adVarChar, adParamInput, 50, userName)