Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A dynamic value is spliced directly into a SQL LIKE pattern without escaping the LIKE metacharacters backslash, percent and underscore. Ordinary SQL string-literal escaping (e.g. DbService::escape()) does not neutralize them, so an attacker-controlled value such as a self-registered username of `___` or `%%%` becomes a wildcard pattern (e.g. list LIKE "%___%
A value is interpolated into the SQL text of a SELECT/JOIN expression as an identifier: an identifier list (`${...join(', ')}`) inside a SELECT subquery, or a raw `${name} as alias` select term. SQL identifiers cannot be neutralized with value escaping, so a crafted filter, breakdown or property name can terminate the enclosing subquery, supply its own FROM/
An unescaped variable/property is concatenated into a single-quoted SQL string literal (the '...".".$var."' shape). A single quote inside the value terminates the SQL literal and allows SQL injection. CVE-2026-116218 exploited exactly this in CompanyBankAccount::create(), where the API-controlled 'type' property broke out of the INSERT INTO ...societe_rib VA
Sort tokens are accepted only because the MyBatis-Plus deny-list SqlInjectionUtils.check() does not flag them, then become OrderItem columns that the pagination interceptor interpolates verbatim into the ORDER BY clause. ORDER BY identifiers cannot be JDBC bound parameters, so any SQL expression that evades the deny-list (CASE WHEN, hex(password), user_id+1,
A SQL string literal is built by interpolating a value into a single-quoted literal while escaping only single quotes, so backslashes pass through unescaped. Dialects that process backslash escapes in single-quoted literals (Amazon Redshift, MySQL) parse an embedded '\' as an escape: the doubled quote becomes an escaped quote followed by the literal terminat
SQL query string built by splicing $VAL inside a single-quoted SQL literal ("...'" + $VAL + "'...") or by quote-wrapping a value ("'" + $VAL + "'"), then executed via $DB.query() without a parameters array. A single quote in $VAL terminates the SQL literal, so an attacker-controlled value can inject arbitrary SQL (node-postgres sends a single-string call ove
SQL is assembled by interpolating data ($X) directly inside single-quoted SQL string literals and executed via the Databricks statement-execution API without bind parameters. A crafted memory text, metadata value, or record ID containing a single quote terminates the SQL literal and injects arbitrary SQL (CWE-89): a tautology WHERE clause such as "' OR '1'='
Collected pypika filter criteria are rendered to a raw SQL text fragment with $CRITERION.get_sql(with_namespace=True, quote_char=...) and interpolated into the engine's WHERE clause. pypika's ValueWrapper only escapes quote characters, not backslashes, and MariaDB treats '\' as an escape character inside single-quoted string literals, so a user-controlled fi
Manual SQL escaping that rewrites a single quote into a backslash-escaped quote (\') is incorrect on MySQL/MariaDB servers running with NO_BACKSLASH_ESCAPES: there the backslash is a literal character, so the quote still terminates the SQL string literal and attacker-controlled data can break out of its string context and inject SQL. Escape with the driver's
Raw request parameters read through $_REQUEST (the aggregate request-parameter superglobal) or $_GET are passed as column values to dbInsert(), which builds the INSERT statement by interpolating the supplied values into the SQL text instead of binding them as parameters. These legacy request-parameter flows are unvalidated (at most isset()-guarded) and reach
zen_db_perform() interpolates its 4th argument verbatim as the WHERE clause of the generated UPDATE (only the values of the $data array are escaped). Concatenating a request superglobal ($_POST/$_GET/$_REQUEST/$_COOKIE) directly into that argument — e.g. "txn_id='" . $_POST['txn_id'] . "'" — turns a forged request into executable SQL: arbitrary row selection
A non-literal value (typically Sort.Order::getProperty(), bound from the attacker-controlled `sort` request parameter of paginated endpoints) is converted into an unquoted SQL identifier with Table.column(...) and wrapped in OrderByField.from(...), then rendered verbatim into the SQL ORDER BY clause by SqlRenderer. Without validation against the entity metam
Whether $UNSANITIZED gets sanitized is decided with a prefix parser: parseInt(), parseFloat() and their Number.* equivalents consume only a leading numeric prefix, so parseInt('1) OR 1=1--') returns 1 and Number.isNaN(parseInt($UNSANITIZED)) is false for any input that merely starts with a digit. The raw $UNSANITIZED branch of this ternary is therefore emitt
An array is joined with a tight quote-comma-quote separator (no spaces) and the joined text is wrapped directly in bare, matching SQL string-quote literals, building an unescaped SQL string-literal list by hand (for example the operand of a `col IN (...)` clause). Under MySQL/MariaDB default sql_mode an array element ending in a backslash escapes the auto-in
A database identifier or string literal derived from stored schema metadata (a property access into an introspection/schema document) is interpolated directly into a raw SQL/DDL template literal, with the enclosing backtick (MySQL) or single quote (T-SQL) supplied by the surrounding string instead of by an escaping/quoting call. A planted column/table name c
$VAL is concatenated directly into a single-quoted SQL string literal. A single quote in $VAL terminates the literal and lets an attacker append arbitrary SQL (e.g. UNION SELECT) to the statement. Escape quotes before concatenation (e.g. strings.ReplaceAll($VAL, "'", "''")) or use a bound parameter instead.
Request-controlled value $COND is passed to a GORM query method as the only condition argument. GORM interprets a single non-slice condition argument as an inline raw SQL WHERE clause rather than a bound parameter, so the value is interpolated directly into the query (e.g. WHERE 1 AND SLEEP(5)). Validate and convert the input (e.g. strconv.Atoi) and use the
Text extracted from a parsed document node ($NODE.Text()) reaches a SQL string literal built by concatenation without escaping single quotes. A single quote in attacker-controllable content closes the SQL string literal and allows arbitrary SQL injection into the executed statement. Escape the value for the SQL string literal context before interpolation, e.
A raw value is interpolated directly inside a single-quoted ClickHouse SQL string literal, either as a quoted tuple of format verbs (('%s','%s')) or as a quoted verb aliased into the projection ('%s' AS ...), assembled with fmt.Sprintf (inline format string or a raw SQL template literal formatted later). The value is never neutralized for the string-literal
SQL comparison operators should not be sanitized with esc_sql(). esc_sql() only escapes characters for quoted string literals and does not prevent SQL injection when operators are interpolated unquoted into SQL clauses. Validate comparison operators against an allowlist of permitted operators instead.
Using `.contains()` with a dictionary or list on a SQLAlchemy JSON column compiles to a `LIKE '%...%'` substring match on SQLite and MySQL. This allows SQL wildcards (`%`, `_`) in user inputs to match unintended records, potentially leading to identity spoofing or authentication bypass. Use JSON subscripting with exact comparison (e.g., `Column[key].as_strin
The order direction is directly concatenated or interpolated into a SQL expression after only converting case (e.g., via `.toLowerCase()` or `.toUpperCase()`). This does not prevent SQL injection if untrusted user input is passed as the sort direction. Validate the direction against a strict allowlist of permitted values (such as 'asc' and 'desc') before inc
Unsanitized input is interpolated or concatenated into a WordPress database query format string. Use %s / %d placeholders with $wpdb->prepare() and pass user values in the arguments array.
The comma-separated request parameter $NAME is read as an unconstrained string and split into array $LIST with explode(), but no element is validated as a UUID. Elements of this array are concatenated into SQL (e.g. an IN ('...') list built with implode and executed with empty bind parameters) instead of being bound, so characters that survive the framework'
