title: Project using [Dapper] gets reported by Veracode as CWE ID 89 (Improper Neutralization of Special Elements used in an SQL Command)
body: <p>We have a .Net 4.0 project that is being scanned by Veracode in order to acquire security certification.</p>
  
  <p>During static scan the following vulnerability has been found:
  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE ID 89) See details at <a href="https://cwe.mitre.org/data/definitions/89.html" rel="nofollow">https://cwe.mitre.org/data/definitions/89.html</a> </p>
  
  <p>The report details file &amp; line number that seems to refer to Dapper:</p>
  
  <p>OurOwnDll.dll      dev/.../dapper net40/sqlmapper.cs 1138</p>
  
  <p>App_Browsers.dll   dev/.../sqlmapperasync.cs 126</p>
  
  <p>OurOwnDll is using Dapper.</p>
  
  <p>App_Browsers.dll I´m not aware where it is coming from, but seems to be related to the site project, and seems to be related to the browsers capabilities detection of asp.net.</p>
  
  <p>I would like to know if there is any way to prevent this vulnerability.</p>