Zennoxa Shield
Rules / Swift
SHIELD-SWIFT-002

SQL injection via string concatenation

criticalSwiftCWE-89CVSS 8.8

What it detects

A raw SQL query is assembled with the concatenation operator on variable input.

How to fix

Use parameterized queries with bound placeholders rather than concatenating strings.

Vulnerable — Shield flags thisUserQuery.swift
import SQLite

func findUser(db: Connection, userId: String) throws -> Statement {
    let query = "SELECT * FROM users WHERE id = " + userId
    return try db.prepare(query)
}
Fixed — scans cleanUserQuery.swift
import SQLite

func findUser(db: Connection, userId: String) throws -> Statement {
    return try db.prepare("SELECT * FROM users WHERE id = ?", userId)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-SWIFT-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-SWIFT-002: SQL injection via string concatenation — Zennoxa Shield