Raw SQL Injection Risk (ARCH8055)

Key kotlin.orm.raw-sql-injection-risk · Severity critical · Category orm · CWE CWE-89

Flags raw SQL built with string templates or concatenation and handed to a query API (createQuery, rawQuery, execSQL, prepareStatement).

Incorrect

db.rawQuery("SELECT * FROM users WHERE name = '$name'", null)

Correct

db.rawQuery("SELECT * FROM users WHERE name = ?", arrayOf(name))

Fix

Bind parameters; never interpolate values into SQL text.