title: How to deal with this SQL injection warning (CA2100)
body: <p>Below is the code I got from Microsoft page: <a href="https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand(v=vs.110).aspx" rel="nofollow noreferrer">SqlCommand</a></p>
  
  <pre><code>public static Int32 ExecuteNonQuery(String connectionString, String commandText, CommandType commandType, params SqlParameter[] parameters)
  {
          using (SqlConnection conn = new SqlConnection(connectionString))
          {
              using (SqlCommand cmd = new SqlCommand(commandText, conn))
              {
                  // There're three command types: StoredProcedure, Text, TableDirect. The TableDirect 
                  // type is only for OLE DB.  
                  cmd.CommandType = commandType;
                  cmd.Parameters.AddRange(parameters);
  
                  conn.Open();
                  return cmd.ExecuteNonQuery();
              }
          }
  }
  </code></pre>
  
  <p>However, VS code analysis still complains about "CA2100":</p>
  
  <blockquote>
    <p>Warning   CA2100  The query string passed to 'SqlCommand.SqlCommand(string, SqlConnection)' in 'FlexClaimFormRepository.ExecuteNonQuery(string, string, CommandType, params SqlParameter[])' could contain the following variables 'commandText'. If any of these variables could come from user input, consider using a stored procedure or a parameterized SQL query instead of building the query with string concatenations.</p>
  </blockquote>
  
  <p>I know the exact reason why the warning is there, but anyidea on how to get rid of it? Given setting commandText inside the function is not acceptable since I want it to be a parameter.</p>