Avoid raw or interpolated SQL

#Metadata

Rule ID

security.no-sql-interpolation

Severity

high

Confidence

0.95

Languages

go, java, javascript, php, python, ruby, rust, typescript

Presets

recommended, security, strict

Stability

stable

Applies to

block

Tags

injection, rules-catalog, security, sql

#Why it matters

Raw or interpolated SQL can let attackers control query structure when values are not passed separately.

#Remediation

Use prepared statements, placeholder parameters, or a typed query builder instead of executing raw SQL text.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/shared/security.no-sql-interpolation.rule.yaml.