title: Checkmarx Second Order SQL Injection C#
body: <p>I'm getting this error from <em>Checkmarx</em>:</p>
  <blockquote>
  <p>The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.</p>
  </blockquote>
  <pre class="lang-cs prettyprint-override"><code>public class CurrClientEntity
      {       
           
          public string C_Code { get; set; }
          
          public string C_Id { get; set; }        
      }
  
  
   public CurrClientEntity GetCurrClientId(string c_Code)       
   {           
              var sql = new StringBuilder(@&quot;SELECT C_CODE,C_ID FROM TBL_CLIENT&quot;); 
  
              sql.Append(&quot; WHERE VALID =:VALID  &quot;);
              sql.Append(&quot; AND C_CODE = :C_CODE  &quot;);
              var dictionary = new Dictionary&lt;string, object&gt;
                          {
                              { &quot;@C_CODE&quot;, c_Code },
                              { &quot;@VALID&quot;, 'Y' },
                          };
              var parameters = new DynamicParameters(dictionary);
              using (IDbConnection conn = CreateConnection())
              {
                  return conn.QueryFirstOrDefault&lt;CurrClientEntity&gt;(sql.ToString(), parameters);
              }
          }
  </code></pre>