No rule selected
G-9501 – Never use parameter in string expression of dynamic SQL. Use asserted local variable instead.
The use of static SQL eliminates the risk of SQL injection. However, if you write dynamic SQL you are responsible to ensure that the SQL cannot be injected with malicious SQL statements. This check looks for unasserted parameters used in `execute immediate` statements and `open for` statements. All parameters used in these statements must be asserted with one of the subprograms provided by `dbms_assert`.
Tags: Dynamic SQL, Stored Object.
Quality area: Security. Severity: Blocker. Fixing time: Local-medium.
Press p or n to quickly navigate to the previous/next rule.