title: FindBugs does not detect SQL injection
body: <p>I have a encountered a case where FindBugs did not detect SQL injection on my project. Project is built using Gradle and FindBugs plugin is used. I am using hibernate to connect to DB. Below is the section that contains SQL injection,</p>
  
  <pre><code>public List&lt;String&gt; fetchApplicationRequests(String applicationId,
          String fromDate, String toDate) throws ParseException {
      String sb = "SELECT * FROM table where applicationid = " + applicationId;
      Query query = getCurrentSession().createQuery(sb);
      query.setParameter("appId", applicationId);
      return (List&lt;String&gt;) query.list();
  }
  </code></pre>
  
  <p>Clearly the above section shows an SQL injection. When I ran the same project using Veracode, it showed SQL injection for the section I have mentioned. Below is the FindBugs plugin section under my <code>build.gradle</code>.</p>
  
  <pre><code>apply plugin: "findbugs"
  
  findbugs {
    toolVersion = '3.0.1'
    effort = "max"
    ignoreFailures = true
    findbugsTest.enabled = false
  }
  tasks.withType(FindBugs) {
    reports {
        xml.enabled = false
        html.enabled = true
   }
  }
  </code></pre>
  
  <p>When I ran the commmand:</p>
  
  <pre class="lang-none prettyprint-override"><code>&gt; ./gradlew clean build
  </code></pre>
  
  <p>It showed a list of bugs identified in my project under <code>build/reports/findbugs/main.html</code></p>
  
  <p>Below is the list of errors detected by FindBugs,</p>
  
  <ul>
  <li>Bad practice Warnings - 6</li>
  <li>Correctness Warnings - 17</li>
  <li>Internationalization Warnings - 31</li>
  <li>Malicious code vulnerability Warnings - 52</li>
  <li>Performance Warnings - 15</li>
  <li>Dodgy code Warnings - 46</li>
  </ul>
  
  <p>I expect SQL injection which comes under <strong>Security category</strong> which is not detected,</p>
  
  <p><a href="http://findbugs.sourceforge.net/bugDescriptions.html#SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE" rel="nofollow noreferrer">Bug description: FindBugs</a></p>
  
  <p>How can this be fixed or is there any other way I can detect SQL injection in my project?</p>