Zennoxa Shield
Rules / Python
SHIELD-PY-002

SQL Injection via f-string interpolation

criticalPythonCWE-89CVSS 9.8

What it detects

Using f-strings to construct SQL queries allows injection attacks.

How to fix

Use parameterized queries. Never interpolate values directly into SQL strings.

Vulnerable — Shield flags thisorders.py
def get_order(conn, order_id):
    conn.query(f"SELECT * FROM orders WHERE id = {order_id}")
    result = conn.store_result()
    return result.fetch_row()
Fixed — scans cleanorders.py
def get_order(conn, order_id):
    cur = conn.cursor()
    cur.execute("SELECT * FROM orders WHERE id = %s", (order_id,))
    return cur.fetchone()

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-002: SQL Injection via f-string interpolation — Zennoxa Shield