Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-001

SQL Injection via string concatenation

criticalJavaScript / TypeScriptCWE-89CVSS 9.8

What it detects

Detected SQL query built by string concatenation with user input, which may allow SQL injection.

How to fix

Use parameterized queries or prepared statements instead of string concatenation.

Vulnerable — Shield flags thisusers.js
const db = require("./db");

function getUserById(userId, callback) {
  db.query("SELECT id, email FROM users WHERE id = " + userId, callback);
}

module.exports = { getUserById };
Fixed — scans cleanusers.js
const db = require("./db");

function getUserById(userId, callback) {
  db.query("SELECT id, email FROM users WHERE id = ?", [userId], callback);
}

module.exports = { getUserById };

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-001: SQL Injection via string concatenation — Zennoxa Shield