Zennoxa Shield
Rules / Rust
SHIELD-RUST-015

SQL statement built with format!

highRustCWE-89CVSS 8.1

What it detects

A SQL query assembled with format! interpolates values into the statement and risks injection.

How to fix

Build queries with bound parameters instead of format!; never interpolate values into SQL text.

Vulnerable — Shield flags thisusers.rs
use postgres::{Client, Error, Row};

pub fn find_user(conn: &mut Client, user_id: i64) -> Result<Vec<Row>, Error> {
    let sql = format!("SELECT name, email FROM users WHERE id = {}", user_id);
    conn.query(sql.as_str(), &[])
}
Fixed — scans cleanusers.rs
use postgres::{Client, Error, Row};

pub fn find_user(conn: &mut Client, user_id: i64) -> Result<Vec<Row>, Error> {
    conn.query("SELECT name, email FROM users WHERE id = $1", &[&user_id])
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-015: SQL statement built with format! — Zennoxa Shield