react-doctor/raw-sql-injection-risk
Building a SQL query by string concatenation or an unsafe raw helper lets an attacker inject SQL and read or modify your database.
- Category: Security
- Severity: warn
- Source:
oxlint-plugin-react-doctor - Framework: global
- Enabled when: production script source files (.js/.ts/.jsx/.tsx/.py/.php); test/scripts/docs/generated paths skipped
- Tags: security-scan
- Default: Enabled
Validate the diagnostic
Confirm the reported code matches this rule before you edit it.
Fires when a query is built outside parameter binding: $queryRawUnsafe(/$executeRawUnsafe(, Prisma.raw(/sql.raw|unsafe( with a non-literal argument, a conn.query("SELECT … ${…}") interpolation, .query("…" + …) concatenation, .where|orderBy|havingRaw( non-literal, or Python/PHP equivalents (cursor.execute(f"…"), engine/session.execute(...), $x->query("…".$…), mysqli_query(...)). It skips parameterized usage — a pure string literal, or an interpolation wrapped in sanitize/escape/quote. FALSE POSITIVE: the interpolated segment is a hard-coded allowlisted identifier rather than user data.
How to fix
Follow the rule guidance while preserving unrelated behavior.
Copyable fix prompt
Copy this self-contained prompt into your coding agent after you confirm the diagnostic.
$queryRaw tagged templates (not the *Unsafe helpers), db.query("… WHERE id = $1", [id]), or the ORM builder. Validate any unavoidable dynamic identifier (table or column name) against a fixed allowlist. In Python use parameterized cursor.execute(sql, params); in PHP use prepared statements with bound parameters.Related rules
More Security rules from the rules reference:
react-doctor/react-markdown-unsanitized-raw-html: Unsanitized raw HTML in React Markdownreact-doctor/react-router-csp-nonce-consistency: CSP nonce is not shared across server renderingreact-doctor/repository-secret-file: A committed env file, credential, or token is exposed to anyone with repo access and must be rotated, even after you remove it.react-doctor/request-body-mass-assignment: Request input spread without field allowlistreact-doctor/require-pnpm-hardening: pnpm project is missing supply-chain hardening in pnpm-workspace.yaml — set `minimumReleaseAge`, keep `blockExoticSubdeps: true`, and set `trustPolicy: no-downgrade`