# Sql injection code is not failing in sonarqube why?

**URL:** <https://community.sonarsource.com/t/sql-injection-code-is-not-failing-in-sonarqube-why/132580>\
**Category:** SonarQube Server / Community Build\
**Created:** [December 23, 2024, 5:53am UTC](https://community.sonarsource.com/t/sql-injection-code-is-not-failing-in-sonarqube-why/132580 "2024-12-23T05:53:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David15](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@David15](https://community.sonarsource.com/u/David15)\
**Post date:** [December 23, 2024, 5:53am UTC](https://community.sonarsource.com/t/sql-injection-code-is-not-failing-in-sonarqube-why/132580/1 "2024-12-23T05:53:38Z")

</div>

I have sampe.sql file . The file has sql injection issue, but still sonarqube Quaity gate is passed.  
Why sonarqube is not detecting it.  
below is my sample. sql

```auto
BEGIN 
  CREATE TABLE Users (
    UserID INT PRIMARY KEY,
    UserName VARCHAR(50),
    Password VARCHAR(50)
  );
   
  DECLARE @UserName VARCHAR(50);
  DECLARE @Password VARCHAR(50);
  DECLARE @SQLQuery NVARCHAR(1000);
   
  -- Hardcoded credentials
  SET @UserName = 'admin'; 
  SET @Password = 'password123'; -- Hardcoded password
   
  SET @SQLQuery = N'SELECT * FROM Users WHERE UserName = ''' + @UserName + ''' AND Password = ''' + @Password + '''';
  
  EXEC sp_executesql @SQLQuery;
END 

```

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [December 24, 2024, 8:21am UTC](https://community.sonarsource.com/t/sql-injection-code-is-not-failing-in-sonarqube-why/132580/2 "2024-12-24T08:21:41Z")

</div>

Hey there.

When I analyze this code as T-SQL, I get a security hotspot raised to review the hardcoded password.

 ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/8/e/8e75cd8abe9ecc026b8b09978a9dacb4ac251a93.png)

Are you expecting another issue to be raised?

---

<div class="post-metadata">

**Author:** ![David15](https://avatars.discourse-cdn.com/v4/letter/d/dc4da7/32.png) [@David15](https://community.sonarsource.com/u/David15)\
**Post date:** [December 31, 2024, 7:52am UTC](https://community.sonarsource.com/t/sql-injection-code-is-not-failing-in-sonarqube-why/132580/3 "2024-12-31T07:52:20Z")

</div>

When I analyzed the code as T-SQL, I identified a security hotspot.

Thanks for your assistance.