← Rule catalog

rust-doctor · Security

`sql-injection-risk`

Flags `format!()` output passed to `.query()`, `.execute()`, or `.raw()` methods. String interpolation in SQL queries enables SQL injection attacks.

Severity: error
Confidence: medium
Analyzer: syn-ast
Default policy: Enabled

Tags

heuristic
security

Framework requirements

No framework requirement.

Limitations

String-built queries are heuristic evidence; the rule cannot prove that interpolated data is untrusted.

Remediation

Use parameterized queries (`$1`, `?`) provided by your database library (sqlx, diesel, sea-orm).

Fix capability: guidance