SQL query built by string interpolation

A SQL string is assembled with a template literal or concatenation and passed to a database driver. Any value interpolated into it is executed as SQL, so a request parameter can read, modify, or destroy data the query was never meant to touch. Use the driver's parameter binding instead; every driver has it.

high likely application source OWASP A03:2021 / CWE-89

What it looks like

HIGH likely SQL query built by string interpolation A03:2021 app/api/login/route.ts:16:5 14 │ // sql-injection 15 │ const rows = await pool.query( 16 │ `SELECT id, role FROM users WHERE email = '${body.email}'`, │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ query text is built at runtime 17 │ )

From app/api/login/route.ts in the fixture suite. The fixture test asserts this finding.

How to fix it

Pass the values as query parameters instead of interpolating them. Every driver supports it, and the binding is not optional formatting - it is what stops the value being parsed as SQL.

The fix for your framework

Choose the API used by your project.

Check your own repository

npx owlwarden scan --preset deep
npx owlwarden explain sql-injection

explain prints the rule and fixes in the terminal. It does not use the network.

All 25 rules / owlwarden