All rules →
Rules / Kotlin
SHIELD-KOTLIN-002

SQL injection via string concatenation in query APIs

criticalKotlinCWE-89CVSS 9.8

What it detects

Building a SQL string with the + operator and passing it to rawQuery, execSQL, or executeQuery permits SQL injection.

How to fix

Use PreparedStatement with bound parameters or selectionArgs rather than concatenating strings.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-002: SQL injection via string concatenation in query APIs — Zennoxa Shield