Skip to content
Sarj Sarj Sarj Standards

no-dynamic-sql

Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.

dynamicSql Rule source Tests Catalog JSON

Why

Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.

Fix

Use SQL placeholders and pass runtime values through the driver's binding API.

Examples

Before — flagged A runtime value is interpolated into SQL
src/users.ts
db.prepare(`select * from users where id = '${userId}'`);
After — preferred A runtime value is bound separately
src/users.ts
db.prepare("select * from users where id = ?").bind(userId);

Options

{
  "additionalProperties": false,
  "properties": {
    "methods": {
      "description": "Statement-taking method names to inspect. Replaces the defaults.",
      "items": { "type": "string" },
      "type": "array"
    }
  },
  "type": "object"
}