Wrong squiggle information on sting variable

[RonnieHegelund]

string sql = "SELECT " + selection + " FROM myTable WHERE " + where;

var cmd4 = new SqlCommand(sql);

[vendettamit]

IMO it looks more like "Sql Injection" and should be reported with severity of error. I will create another issue to create Analyzer to detect sql injection and add this issue there.