Classification

Overview

The application performs incorrect comparison to NULL using =, !=, or <>. In the ANSI SQL standard, the value of NULL is defined as unknown. It is not equal to anything, not even another NULL value. Also, a null value is never not equal to another value. By default, T-SQL complies to the standard, but it can be changed using the SET ANSI_NULLS OFF command. It is recommended to make all T-SQL code ANSI compliant.

References

1. CWE-480: Use of Incorrect Operator
2. Null Values - msdn.microsoft.com