criticalUser input reaching your database

SQL Query String Concatenation

SQL queries are built by concatenating user-supplied values directly into the query string.

Why it matters

An attacker can inject arbitrary SQL commands by manipulating the input values. This can lead to data theft, data modification, authentication bypass, or complete database takeover. SQL injection is consistently ranked as the most dangerous web application vulnerability.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Template literal SQL with req.params
app.get('/users/:id', async (req, res) => {
  const result = await db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
  res.json(result.rows);
});

The smallest fix

minimal patch
// Replace string concatenation with parameterized queries:
// BEFORE (vulnerable):
// db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
// AFTER (safe):
db.query('SELECT * FROM users WHERE id = $1', [req.params.id]);

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// Use an ORM or query builder:
const user = await db.select().from(users).where(eq(users.id, id));

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] at line [the line number] has SQL injection via string concatenation: [the flagged code]. Replace all string concatenation in SQL queries with parameterized queries ($1, $2 or ? placeholders) to prevent SQL injection.

How to check the fix worked

1. Attempt SQL injection with `' OR 1=1 --` in the input — expect no data leak
2. Verify queries use parameterized placeholders ($1, ?, :name)
3. Run sqlmap against the endpoint to confirm it's not injectable

Further reading