TypeScript · security

no-dynamic-sql

eslint:no-dynamic-sql

Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods.

Default: error
Fix: none
Languages: typescript

Why

Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.

Fix

Use SQL placeholders and pass runtime values through the driver's binding API.

Before / after

Executed by this rule’s unit tests.

Before

A runtime value is interpolated into SQL

src/users.ts · focus

db.prepare(`select * from users where id = '${userId}'`);

After

A runtime value is bound separately

src/users.ts · focus

db.prepare('select * from users where id = ?').bind(userId);

Limits

The rule recognizes SQL by syntax and configured method names; static fragments and parameterizing tagged templates are exempt.

Message IDs

dynamicSql

Options

{
  "additionalProperties": false,
  "properties": {
    "methods": {
      "description": "Statement-taking method names to inspect. Replaces the defaults.",
      "items": {
        "type": "string"
      },
      "type": "array"
    }
  },
  "type": "object"
}