Review the query string passed to {0} in {1} for possible SQL injection attacks. If the string is composed using any user ...

Review the query string passed to {0} in {1} for possible SQL injection attacks. If the string is composed using any user input, consider using a stored procedure or a parameterized SQL query instead of building the query with string concatenations.