SQL Injection

Critical

Detects SQL injection vulnerabilities in database queries.

What It Checks

  • String concatenation in SQL queries
  • Template literals in query strings
  • Unparameterized queries with user input

Vulnerability Example

// Vulnerable const query = `SELECT * FROM users WHERE id = ${userId}`; const results = await db.query(query); // Safe const results = await db.query('SELECT * FROM users WHERE id = ?', [userId]);

Severity

Critical - Can lead to data exfiltration, data modification, or complete database compromise.

Remediation

  1. Use parameterized queries or prepared statements
  2. Use an ORM with built-in query parameterization
  3. Validate and sanitize all user inputs
  4. Apply the principle of least privilege to database users