title: How to avoid CA2100 with a constructed query
body: <p>In many places in my code I'm building a SQL statement using StringBuilder, and in every case this triggers a <code>CA2100: Review SQL queries for security vulnerabilities</code> from Code Analysis, because the SQLCommand contents come from the StringBuilder rather than a literal.</p>
  
  <p>Often these queries are assembled via some flow control (case or if), where pieces of the query might be conditional.</p>
  
  <p>My question is, should I suppress every single one of these, or is there a different pattern for building (sometimes complex) queries inline, but avoiding the warning?</p>
  
  <p>An example of code which triggers this:</p>
  
  <pre><code>System.Text.StringBuilder sb = new System.Text.StringBuilder();
  
  sb.AppendLine("select ");
  sb.AppendLine("  Q.QUOTE_TITLE as [@Description] ");
  sb.AppendLine("from ");
  sb.AppendLine("  QUOTE Q ");
  sb.AppendLine("where ");
  sb.AppendLine("  Q.QUOTE_ID = @QUOTE_ID ");
  sb.AppendLine("  and Q.QUOTE_VERS = @QUOTE_VERS  ");
  sb.AppendLine("for xml path('Contract') ");
  
  SqlCommand sqlCmd = new SqlCommand(sb.ToString(), MainDBConnection);
  sqlCmd.Parameters.Add("@QUOTE_ID", SqlDbType.Int).Value = QuoteID;
  sqlCmd.Parameters.Add("@QUOTE_VERS", SqlDbType.SmallInt).Value = QuoteVersion;
  </code></pre>