Potential SQL Injection
SQL injection via string concatenation or template literals in queries. AI tools can generate this pattern because the syntax is shorter than the safe version.
What this rule detects
VC006 finds SQL queries built by interpolating values directly into the query string — template literals (`SELECT * FROM users WHERE id = ${id}`) and string concatenation, in JavaScript/TypeScript and Python. Python f-strings and %-formatting are not detected. It also flags a query string held in a variable when that string was built from request input earlier in the same file.
Vulnerable vs. safe code
// Template literal — looks innocent, is SQL injection.
app.get("/users", async (req, res) => {
const result = await db.query(`
SELECT * FROM users WHERE id = ${req.query.id}
`);
res.json(result.rows);
});
// Attack: GET /users?id=1;DROP TABLE users;--// Parameterized query — value is bound separately from the SQL string.
app.get("/users", async (req, res) => {
const result = await db.query(
"SELECT * FROM users WHERE id = $1",
[req.query.id]
);
res.json(result.rows);
});Most modern ORMs (Prisma, Drizzle, Kysely) make injection nearly impossible because they build queries from JS values rather than strings. If you're using one of those and still seeing VC006 fire, you're probably in a `$queryRaw` or equivalent escape hatch — that's the path to audit.
About A03:2021 — Injection
Injection happens when user input is concatenated directly into SQL queries, shell commands, HTML, or any other interpreter. Injection has appeared in every edition of the OWASP Top 10 since the first list in 2003, and ranked #1 in 2010, 2013 and 2017.
Impact: SQL injection: attacker reads or modifies your entire database. Command injection: attacker runs arbitrary shell commands on your server. XSS: attacker steals session cookies and impersonates other users. Each one is typically a critical-severity finding.
How to fix it: Always use parameterized queries (prepared statements) for SQL. Never use template literals or string concatenation with user input in queries. For HTML output, use your framework's auto-escaping. For shell commands, use APIs that take an array of arguments instead of `exec()` with a string.
Common patterns in this category:
- SQL queries built with string concatenation or template literals
- `child_process.exec()` called with user input concatenated into the command
- `dangerouslySetInnerHTML` with user-controlled data
- `eval()` or `Function()` called with user input
- `innerHTML` assignment without sanitization
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
Scan your code for VC006
Free, no signup: paste code or upload a file, or run npx xploitscan@latest scan . The free scan runs 30 core rules; paid plans run all 223.