public int ExecuteNonQuery(string query, SqlParameter[] parameters)
{
    using (SqlCommand command = CreateCommand(query, parameters))
    {
        int rowsAffected = command.ExecuteNonQuery();
        log.Debug("rows affected: {0}", rowsAffected);
        return rowsAffected;
    }
}

private SqlCommand CreateCommand(string commandText, SqlParameter[] parameters)
        {
            SqlCommand retVal = this.connection.CreateCommand();
            retVal.CommandText = commandText;
            retVal.CommandTimeout = this.commandsTimeout;
            retVal.Parameters.AddRange(parameters);
            return retVal;
        }

 public int ExecuteNonQuery(string query, SqlParameter[] parameters)
 {
     using (SqlCommand command = CreateCommand(query, parameters))
     {
         int rowsAffected = command.ExecuteNonQuery();
         log.Debug("rows affected: {0}", rowsAffected);
         return rowsAffected;
     }
 }

private SqlCommand CreateCommand(string commandText, SqlParameter[] parameters)
 {
     SqlCommand retVal = this.connection.CreateCommand();
     retVal.CommandText = commandText;
     retVal.CommandTimeout = this.commandsTimeout;
     retVal.Parameters.AddRange(parameters);
     return retVal;
}

I was assigned a task to fix the SQL injection flaw reported by a code analysis tool and I am not the original author of the code and I do have fair amount of knowledge on SQL.

1 public int ExecuteNonQuery(string query, SqlParameter[] parameters)
2 {
3   using (SqlCommand command = CreateCommand(query, parameters))
4   {
5       int rowsAffected = command.ExecuteNonQuery();
6       log.Debug("rows affected: {0}", rowsAffected);
7       return rowsAffected;
8   }
9 }

My questions are:

1. Is there any injection risk in this code?
2. If yes, how do I recognize?

I was assigned a task to fix the SQL injection flaw reported by a code analysis tool. I am not the original author of the code. I am fairly knowledgeable with SQL.

public int ExecuteNonQuery(string query, SqlParameter[] parameters)
{
    using (SqlCommand command = CreateCommand(query, parameters))
    {
        int rowsAffected = command.ExecuteNonQuery();
        log.Debug("rows affected: {0}", rowsAffected);
        return rowsAffected;
    }
}

Is there any injection risk in this code? If yes, how do I recognize it?

Here is the code...

and the tool has reported the injection flaw at the line number 3. The ExecuteNonQuery is being called from so many places. Here is one such sample.

Here is the CreateCommand code

My questions are,

Your help appreciated.

and the tool has reported the injection flaw at the line number 3. The ExecuteNonQuery is being called from so many places. 

Here is one such sample:

Here is the CreateCommand code:

My questions are: