Raw SQL Injection Risk (ARCH9055)

Key swift.orm.raw-sql-injection-risk · Severity critical · Category orm · CWE CWE-89

Flags raw SQL or predicate strings built with interpolation (sqlite3_exec, FMDB executeQuery, NSPredicate(format:) with (…)).

Incorrect

let predicate = NSPredicate(format: "name == '\(name)'")

Correct

let predicate = NSPredicate(format: "name == %@", name)

Fix

Use format arguments / bound parameters; never interpolate values into query text.