SQL injection risk
Investigates lower-trust input that changes SQL syntax in a reachable database operation.
| Detail | Value |
|---|---|
| Check ID | SQL_INJECTION |
| Severity | High |
| How it runs | Agent review |
Anchor to How to fixHow to fix
Bind query values and use trusted mappings or safe identifier quoting for dynamic SQL structure.
For more detail, see OWASP SQL Injection Prevention Cheat Sheet.
Don’t
- Concatenate or interpolate request input, stored notes, or webhook fields into SQL text.
- Build the query string for a raw-query API, such as Prisma's
$queryRawUnsafeor$executeRawUnsafe, from request input. - Take table names, column names, or sort directions straight from a request. Placeholders can bind values, but they can't bind identifiers or keywords.
Do
- Bind values through your ORM's query builder or the driver's placeholders. Prisma's
$queryRawtagged template binds every interpolated value. - Map table names, columns, and sort directions from user input to a fixed set of SQL fragments.
- Keep SQL structure separate from data, including
INlists,LIKEpatterns, andORDER BY.
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?