SQL Injection (ARCH9100)
Ce contenu n’est pas encore disponible dans votre langue.
Key swift.security.sql-injection · Severity error · Category security · CWE CWE-89
Flags SQL execution APIs (sqlite3_exec, sqlite3_prepare_v2, FMDB executeQuery/executeUpdate) called with interpolated query text.
Incorrect
Section titled “Incorrect”sqlite3_exec(db, "DELETE FROM users WHERE id = \(id)", nil, nil, nil)Correct
Section titled “Correct”sqlite3_prepare_v2(db, "DELETE FROM users WHERE id = ?", -1, &stmt, nil)sqlite3_bind_int(stmt, 1, id)Bind parameters; never interpolate values into SQL.