Trying to work out if this a valid issue with my code, or just a false positive I can note in report for Security Review.
I have provided a slightly simplified version below. The Id I am querying for is provided as a bind variable, though the field I am querying is also inserted from a setting using dynamic SOQL. I believe the bind variable should mitigate against the SOQL injection, and I would rather do that than use escape single quotes. So not sure if it is the syntax throwing off the scanner, or if there is an issue I am missing?
//Page params is a map for a custom setting called mycustomsetting__c String sQueryFinal = 'SELECT Id, LastName FROM Contact '; mycustomsetting__c conpageparam = pageparams.get('KnownContactId'); String sPersonPageId = conpageparam.kwac__Source_Id__c; sQueryFinal+= ' WHERE '+ conpageparam.kwac__Source_Field__c + ' = :sPersonPageId '; sQueryFinal += ' ORDER BY CreatedDate ASC'; database.executequery(sQueryFinal)