codeql/csharp/ql/test/query-tests/Security Features/CWE-838/SqlEncode.cs

using System;
using System.Data;
using System.Data.SqlClient;
using System.Web;
using System.Net;

public class SqlEncode
{
    public static DataSet Bad(HttpContext ctx)
    {
        var user = WebUtility.UrlDecode(ctx.Request.QueryString["user"]);
        using (var connection = new SqlConnection(""))
        {
            var query = "select * from Users where Name='" + user.Replace("\"", "\"\"") + "'"; // $ Source=r11
            var adapter = new SqlDataAdapter(query, connection); // $ Alert=r11
            var result = new DataSet();
            adapter.Fill(result);
            return result;
        }
    }

    public static DataSet Good(HttpContext ctx)
    {
        var user = WebUtility.UrlDecode(ctx.Request.QueryString["user"]);
        using (var connection = new SqlConnection(""))
        {
            var query = "select * from Users where Name=@name";
            var adapter = new SqlDataAdapter(query, connection);
            var parameter = new SqlParameter("name", user);
            adapter.SelectCommand.Parameters.Add(parameter);
            var result = new DataSet();
            adapter.Fill(result);
            return result;
        }
    }
}