SQL Keyword Delimit¶

What does this mean ?¶

Concatenated SQL fragments can accidentally merge an identifier and a keyword. A missing space is normally a query construction bug. Fixing that space does not secure a query that also concatenates untrusted values.

What can happen ?¶

The database may reject the resulting SQL or interpret a token differently from what the author intended. Failures can interrupt an operation or leave a poorly handled transaction incomplete. This finding alone is not evidence of SQL injection.

Recommendation¶

Use readable constant query text, check every token boundary, and bind user-controlled values through the database driver's parameter API. Placeholder syntax is provider-specific. Parameters represent values, not arbitrary table names, keywords, or ordering clauses; select dynamic identifiers from an application-controlled allowlist. See ADO.NET parameter guidance.

Sample Code¶

These C# fragments assume a fresh DbCommand command from a provider supporting @id parameters and an integer requestedId.

Missing token boundary:

command.CommandText = "SELECT id FROM items" + "WHERE id = @id";

Correct boundary with a bound value:

command.CommandText = "SELECT id FROM items " + "WHERE id = @id";
var parameter = command.CreateParameter();
parameter.ParameterName = "@id";
parameter.DbType = System.Data.DbType.Int32;
parameter.Value = requestedId;
command.Parameters.Add(parameter);

Regression test: execute against an isolated fixture database containing two IDs. Confirm the corrected query returns only the requested row and returns none for an absent ID. Confirm the malformed version fails. Exercise rollback behavior if a surrounding multi-step transaction encounters a query error; do not test against production data.

References¶

• ADO.NET commands and parameters
• Related: SQL injection.