Zennoxa Shield
Rules / Dart
SHIELD-DART-001

SQL injection via raw query interpolation

criticalDartCWE-89CVSS 9.8

What it detects

Raw SQL executed with string-interpolated or concatenated user input allows SQL injection.

How to fix

Use parameterized queries with whereArgs or positional argument lists instead of interpolation.

Vulnerable — Shield flags thisuser_dao.dart
import 'package:sqflite/sqflite.dart';

Future<List<Map<String, Object?>>> findUser(Database db, String userId) {
  // SQL injection: userId is interpolated straight into the query
  return db.rawQuery("SELECT * FROM users WHERE id = $userId");
}
Fixed — scans cleanuser_dao.dart
import 'package:sqflite/sqflite.dart';

Future<List<Map<String, Object?>>> findUser(Database db, String userId) {
  return db.rawQuery('SELECT * FROM users WHERE id = ?', [userId]);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-001: SQL injection via raw query interpolation — Zennoxa Shield