Source-derived document; reported behaviour, inference and evidence gaps are identified in the text.

Return to: C09 — Security and Trust Boundaries — topic detail

query construction

Security: query construction

D4_Report.print_labels obtains a predicate from Construct.getQuery and concatenates it into a select statement against the customer table before passing the resulting text to a prepared-statement API. The predicate is therefore embedded in the SQL text rather than supplied as a bound parameter. The evidence does not show whether Construct.getQuery restricts or sanitizes the expression, so SQL injection is not proven; the construction is nevertheless a concrete security-review concern. E0012