Zennoxa Shield
Rules / PHP
SHIELD-PHP-001

SQL injection via string concatenation or interpolation

criticalPHPCWE-89CVSS 9.8

What it detects

Query built by concatenating or interpolating variables into mysqli/PDO query calls allows SQL injection.

How to fix

Use parameterized queries with bound placeholders instead of building SQL from variables.

Vulnerable — Shield flags thisproduct.php
<?php
function findProduct(mysqli $db, string $id): ?array {
    $result = $db->query("SELECT * FROM products WHERE id = " . $id);
    return $result->fetch_assoc();
}
Fixed — scans cleanproduct.php
<?php
function findProduct(mysqli $db, string $id): ?array {
    $stmt = $db->prepare("SELECT * FROM products WHERE id = ?");
    $stmt->bind_param("s", $id);
    $stmt->execute();
    return $stmt->get_result()->fetch_assoc();
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-001: SQL injection via string concatenation or interpolation — Zennoxa Shield