TS · security

←Previous Next→

no-dynamic-sql

Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.

dynamicFragmentdynamicSql Rule source Tests Catalog JSON

Why

Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.

Fix

Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.

Examples

Before — flagged A runtime value is interpolated into SQL

src/users.ts

db.prepare(`select * from users where id = '${userId}'`);

After — preferred A runtime value is bound separately

src/users.ts

db.prepare("select * from users where id = ?").bind(userId);

Before — flagged A runtime fragment is interpolated into SQL

src/users.ts

db.prepare(`select id from users where id = ${userId}`);

After — preferred An unquoted runtime value is bound separately

src/users.ts

db.prepare("select id from users where id = ?").bind(userId);

Options

{
  "additionalProperties": false,
  "properties": {
    "methods": {
      "description": "Statement-taking method names to inspect. Replaces the defaults.",
      "items": { "type": "string" },
      "type": "array"
    }
  },
  "type": "object"
}