VBC-004: sql-injection-concatenation

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .jsx, .py, .go, .php, .rb, .java, .cs, .astro
Scope: the whole file, with no scope filtering
Tags: security

What it reports

SQL built by string concatenation at line {line}. An attacker controlling the interpolated value can rewrite the statement. Use parameterized queries or a query builder that binds values separately.

Flagged

db.query("SELECT * FROM users WHERE id = " + id);

sql += " AND status = " + status;

Not flagged

q += " ORDER BY acquired DESC;"

q += " LIMIT 10;"

db.query("SELECT * FROM users WHERE id = $1", [id]);

q += ` AND project = ?`

sql += " AND id = $1"

sql += " AND name = :name"

const label = 'Update ' + count + ' items';

Pattern

(?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*(?=[^\n]*["'`]\s*\+)["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|OR\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`]))