Skip to content

Parameterize order creation SQL - #6

Open
felickz with github-agentic-autofix[bot] wants to merge 2 commits into
masterfrom
agentic-autofix/fix-code-scanning-alerts-193
Open

felickz with github-agentic-autofix[bot] wants to merge 2 commits into
masterfrom
agentic-autofix/fix-code-scanning-alerts-193

Conversation

@github-agentic-autofix

@github-agentic-autofix github-agentic-autofix AI commented Sep 29, 2026 •

Copy link
Copy Markdown

Checkout order fields were interpolated directly into SQL, allowing crafted input to alter database commands. The order creation path now binds all values as parameters.

  • Order insertion: Parameterize order and shipping fields.
  • Order details: Parameterize dynamically generated detail values.
  • Shipment insertion: Parameterize shipment data.
  • Shared binding: Add a helper for null-safe DbParameter creation.
AddParameter(command, "@ShipAddress", order.ShipAddress);
AddParameter(command, "@ShipCity", order.ShipCity);

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
@github-agentic-autofix github-agentic-autofix AI changed the title [WIP] Fix code scanning alert #193 Parameterize order creation SQL Sep 29, 2026
GitHub Agentic Autofix finished work on behalf of felickz September 29, 2026 18:30
@github-agentic-autofix
github-agentic-autofix AI marked this pull request as ready for review September 29, 2026 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants