Sql injection code is not failing in sonarqube why?

SonarQube Server / Community Build
1

I have sampe.sql file . The file has sql injection issue, but still sonarqube Quaity gate is passed.
Why sonarqube is not detecting it.
below is my sample. sql

BEGIN 
  CREATE TABLE Users (
    UserID INT PRIMARY KEY,
    UserName VARCHAR(50),
    Password VARCHAR(50)
  );
   
  DECLARE @UserName VARCHAR(50);
  DECLARE @Password VARCHAR(50);
  DECLARE @SQLQuery NVARCHAR(1000);
   
  -- Hardcoded credentials
  SET @UserName = 'admin'; 
  SET @Password = 'password123'; -- Hardcoded password
   
  SET @SQLQuery = N'SELECT * FROM Users WHERE UserName = ''' + @UserName + ''' AND Password = ''' + @Password + '''';
  
  EXEC sp_executesql @SQLQuery;
END
2

Hey there.

When I analyze this code as T-SQL, I get a security hotspot raised to review the hardcoded password.

image
image2744×1350 333 KB

Are you expecting another issue to be raised?

3

When I analyzed the code as T-SQL, I identified a security hotspot.

Thanks for your assistance.