SQL Server Express localdb security

Question

We were developing an application within .NET that would: read in data (generally in a text or csv format); run some analyses; and generate results/reports from the data. We were using SQL Server Express localdb to create temporary DBs and to perform the analyses. This would all happen locally on one's computer/laptop. Our security team was worried about the possibility of a SQL injection attack. Is this a valid concern? Sorry if I have not provided enough detail and am happy to clarify as needed.

Answer 1

Sql injection is not related to where the database is stored but rather how you construct the sql statements. But maybe they mean the user could modify the data to change the report, but a malicious user could just modify the output.