SonarQube is unable to detect SQL Injection

[Orangean]

Hi,

SonarQube is unable to detect SQL Injection in .ASHX ASP. Net Web.
We are currently using SonarQube Developer Edition
Version: 10.5.0.89998.
Please advise.

[Colin]

Hey there.

I’ve moved your post to the section on reporting false-negatives.

Please review this post:

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

And include a complete reproducer (code).