SQL Injection (ARCH8100)

Key kotlin.security.sql-injection · Severity error · Category security · CWE CWE-89

Flags SQL execution APIs called with a query built from string templates or concatenation.

Incorrect

statement.executeQuery("SELECT * FROM users WHERE id = $id")

Correct

val ps = connection.prepareStatement("SELECT * FROM users WHERE id = ?")
ps.setInt(1, id)

Fix

Use prepared statements with bound parameters.