All rules →
Rules / Rust
SHIELD-RUST-002

SQL injection via diesel sql_query with format!

criticalRustCWE-89CVSS 9.8

What it detects

diesel::sql_query built from format! interpolates untrusted values into raw SQL.

How to fix

Bind parameters with .bind() rather than interpolating into the SQL string.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-002: SQL injection via diesel sql_query with format! — Zennoxa Shield