vetkit.swift.sql-injection.quoted-value-splice
A SQL statement embeds a value inside quotes through string interpolation or concatenation before it is executed (SQLite C API, FMDB, GRDB or SQLite.swift). Any quote in the value breaks out of the literal, which is SQL injection.
Last updated:
Suite: Security
swift
A SQL statement embeds a value inside quotes through string interpolation or concatenation before it is executed (SQLite C API, FMDB, GRDB or SQLite.swift). Any quote in the value breaks out of the literal, which is SQL injection.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Bind values: sqlite3_bind_text with ? placeholders, FMDB executeQuery(_:withArgumentsIn:), GRDB execute(sql:arguments:) or execute(literal:) / SQL interpolation, SQLite.swift prepare(_:_:) with bindings.
References
Source: packages/engine/rules/sast/swift.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.