SQL Injection (ARCH9100)

Key swift.security.sql-injection · Severity error · Category security · CWE CWE-89

Flags SQL execution APIs (sqlite3_exec, sqlite3_prepare_v2, FMDB executeQuery/executeUpdate) called with interpolated query text.

Incorrect

sqlite3_exec(db, "DELETE FROM users WHERE id = \(id)", nil, nil, nil)

Correct

sqlite3_prepare_v2(db, "DELETE FROM users WHERE id = ?", -1, &stmt, nil)
sqlite3_bind_int(stmt, 1, id)

Fix

Bind parameters; never interpolate values into SQL.