SQL built from values with f-strings, concatenation or template strings

Shortcuts that trade away safety: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. lessloc catches it as unsafe: pass values as query parameters.

What makes SQL built from values instead of query parameters a bad practice?

The standards that call it a bad practice: CWE-89 SQL Injection; OWASP Top 10 A03:2021 Injection.

What does lessloc do about SQL built from values instead of query parameters?

lessloc catches it as unsafe: pass values as query parameters.

• unsafe (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, Math.random() for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

Examples

Caught as unsafe:

def find(db, name):
    return db.execute(f"SELECT * FROM users WHERE name = '{name}'")

Written well:

def find(db, name):
    return db.execute("SELECT * FROM users WHERE name = ?", (name,))

Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in Shortcuts that trade away safety:

• HTML built or escaped by hand: lessloc catches it as unsafe: use textContent or the framework's rendering.
• Math.random() or random for tokens and passwords: lessloc catches it as unsafe: crypto.randomUUID(), getRandomValues() or the secrets module.
• Fast hashes (MD5, SHA-1, SHA-256) for passwords: lessloc catches it as unsafe: bcrypt, scrypt or argon2.
• Certificate checks turned off: lessloc catches it as unsafe.
• Running text as code: eval, exec, new Function: lessloc catches it as unsafe: parse the input instead.