Can CodeQL recognize that a SQL injection attack is prevented through input sanitization for C#?
It looks like this is possible with Java
// OK: validate the input first
{
String category = args[1];
Validation.checkIdentifier(category);
Statement statement = connection.createStatement();
String query1 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
+ category + "' ORDER BY PRICE";
ResultSet results = statement.executeQuery(query1);
}
but I haven't been able to find a similar example for C#.
Under normal circumstances of course I would prefer to use bind variables but there are some edge cases where this is not possible.
For example, the Databricks ODBC driver fails with bind variables in non-trivial queries
Is there a solution that will let CodeQL recognize input validation for SQL statements in C#?