Zennoxa Shield
Rules / Python
SHIELD-PY-001

SQL Injection via string formatting

criticalPythonCWE-89CVSS 9.8

What it detects

SQL query built with % formatting or .format() may allow injection.

How to fix

Use parameterized queries with ? or %s placeholders instead of string formatting.

Vulnerable — Shield flags thisusers.py
import sqlite3

def find_user(username):
    conn = sqlite3.connect("app.db")
    cursor = conn.cursor()
    cursor.execute("SELECT id, email FROM users WHERE name = '{}'".format(username))
    return cursor.fetchone()
Fixed — scans cleanusers.py
import sqlite3

def find_user(username):
    conn = sqlite3.connect("app.db")
    cursor = conn.cursor()
    cursor.execute("SELECT id, email FROM users WHERE name = ?", (username,))
    return cursor.fetchone()

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-001: SQL Injection via string formatting — Zennoxa Shield