Hi Mangesh,

Depends on what exactly you're storing in that site property and how it gets used.

If the site property is just a bound value, something like an account name, warehouse, or a filter value fed into a parameterized query, you're fine. The connector's underlying driver parameterizes it before it ever reaches Snowflake, so there's no injection path.

If it's holding a chunk of SQL text itself, a WHERE clause, table name, or anything you're concatenating into the query string before it runs, that's the case to avoid. Site properties are usually locked down to admins in Service Center, so the risk isn't a random end user editing it, but it's still bad practice because anyone who can touch that property like a future teammate who copies the pattern, can push arbitrary SQL.

Can you be more specific on what you're trying to do?