SQL injection via string interpolation in rawQuery/execSQL

Shield rates this critical (CVSS 9.8), classified as CWE-89.

criticalKotlinCWE-89CVSS 9.8

What it detects

SQLiteDatabase rawQuery or execSQL called with a Kotlin string template interpolating a variable allows SQL injection.

Use parameterized queries with selectionArgs placeholders instead of interpolating user input into SQL strings.

Vulnerable — Shield flags thisDao.kt

fun findUser(db: SQLiteDatabase, name: String): Cursor {
    return db.rawQuery("SELECT * FROM users WHERE name = '$name'", null)
}

Fixed — scans cleanDao.kt

fun findUser(db: SQLiteDatabase, name: String): Cursor {
    return db.rawQuery("SELECT * FROM users WHERE name = ?", arrayOf(name))
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-001, the fixed one does not.