Use of SY-UNAME considered a backdoor injection vulnerability

Question

When i am using the code SY-UNAME == "anyname" and providing a value of any user name it give me backdoor injection vulnerability. Is there any way I can fix this?

Answer 1

These constructs are often used by developers in the development system to not impact other users with some experimental code. To make sure that these get removed before transport to QA and production you can create a custom rule for the code inspector (transaction SCI) and enforce running the code inspector in your code review process before changes are moved.

This blog explains how to create these rules.

Answer 2

Yes . Make it a rule not to use such code. It is not good programming. There is no reason why such a code should be required. If you need to restrict access to a program it should ideally be restricted based on authority objects or preferably using roles depending on what you need.