Zennoxa Shield
Rules / Rust
SHIELD-RUST-003

SQL injection via string concatenation

highRustCWE-89CVSS 8.1

What it detects

Concatenating variables into a SQL string with + or push_str allows injection.

How to fix

Use bound parameters instead of concatenating query fragments.

Vulnerable — Shield flags thissrc/users.rs
use mysql::prelude::*;

fn find_user(conn: &mut mysql::Conn, name: String) -> mysql::Result<Vec<String>> {
    let sql = String::from("SELECT email FROM users WHERE name = '");
    conn.query(sql + &name + "'")
}
Fixed — scans cleansrc/users.rs
use mysql::prelude::*;

fn find_user(conn: &mut mysql::Conn, name: String) -> mysql::Result<Vec<String>> {
    conn.exec("SELECT email FROM users WHERE name = ?", (name,))
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-003: SQL injection via string concatenation — Zennoxa Shield