# Security Scanning with SonarQube?

**URL:** <https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225>\
**Category:** SonarQube Server / Community Build\
**Created:** [August 16, 2019, 4:19pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225 "2019-08-16T16:19:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SonarUser3](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@SonarUser3](https://community.sonarsource.com/u/SonarUser3)\
**Post date:** [August 16, 2019, 4:19pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225/1 "2019-08-16T16:19:02Z")

</div>

Hello everyone,

I am new to SonarQube. I tried using the search, but I did not find an answer, so apologies if this is a common question.

I am running SonarQube 7.9.1 on Ubuntu. I have also installed version 3.3.0.1492 of SonarScanner. I am going through the getting started tutorial that is presented when you start the console and browse [http://127.0.0.1:9000](http://127.0.0.1:9000).

I made a simple C# application that is vulnerable to SQL injection. See below.

```
    static void Main(string[] args)
    {
        int i = 0;
        VeryVeryBadSQL(args[0]); 
    }

    static void VeryVeryBadSQL(string pId)
    {
        SqlConnection conn = new SqlConnection("SomeConnectionString");
        SqlCommand comm = new SqlCommand();

        comm.Connection = conn;
        comm.Connection.Open();
        comm.CommandType = System.Data.CommandType.Text;
        comm.CommandText = "SELECT * FROM SomeTable WHERE ID = '" + pId + "'";

        var reader = comm.ExecuteReader(); 
    }

```

When running SonarScanner against this, no SQL injection vulnerabilities are identified. Why is this? Do I need to add a plugin or something? If so, can someone direct me to a resource that shows how to do this?

Thanks,

Must-share information (formatted with [Markdown](https://commonmark.org/help/)):

- which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension)
- what are you trying to achieve
- what have you tried so far to achieve this

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [August 16, 2019, 8:25pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225/2 "2019-08-16T20:25:29Z")

</div>

Dave,

What edition of SonarQube are you using? Injection vulnerability detection is available in [Developer Edition and above](https://www.sonarsource.com/plans-and-pricing/developer/), or on [https://sonarcloud.io](https://sonarcloud.io) (free for open source projects).

Colin

---

<div class="post-metadata">

**Author:** ![SonarUser3](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@SonarUser3](https://community.sonarsource.com/u/SonarUser3)\
**Post date:** [August 16, 2019, 8:39pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225/3 "2019-08-16T20:39:58Z")

</div>

Hi Colin,

Thanks for the response. I downloaded the community edition from this site: [https://www.sonarqube.org/downloads/](https://www.sonarqube.org/downloads/) . This edition says it has security hotspots and vulnerabilities. Does SonarQube classify injections as something other than these?

Thanks,

Dave

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [August 16, 2019, 8:54pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225/4 "2019-08-16T20:54:21Z")

</div>

The detection of Injection Vulnerabilities is a Commercial feature so far as SonarQube is concerned!

Detection of Security Hotspots (make sure \_\_\_\_\_ is safe here) and other kinds of vulnerabilities (hard-coded credentials, left-over logging, etc.) are available in the Community Edition.

---

<div class="post-metadata">

**Author:** ![SonarUser3](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@SonarUser3](https://community.sonarsource.com/u/SonarUser3)\
**Post date:** [August 16, 2019, 8:56pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225/5 "2019-08-16T20:56:05Z")

</div>

Thanks Colin!

---

<div class="post-metadata">

**Author:** ![SonarUser3](https://avatars.discourse-cdn.com/v4/letter/s/c67d28/32.png) [@SonarUser3](https://community.sonarsource.com/u/SonarUser3)\
**Post date:** [August 16, 2019, 9:15pm UTC](https://community.sonarsource.com/t/security-scanning-with-sonarqube/13225/6 "2019-08-16T21:15:44Z")

</div>

I’ve got a followup… I just added some hard coded credentials.

> ```
> public const string USER_NAME = "User1";
> 
> ```

```
       public const string PASSWORD = "Password1!";

```

I still have 0 security findings after doing a scan. Why would it be missing this?

Thanks