SH020: SQL query built from string formatting

Severity: high · Category: security · Applies to: aspnet, django, fastapi, flask, spring

Why it matters

Building a query with f-strings, concatenation or % formatting lets input change the meaning of the query, which is SQL injection.

How to fix

Use parameterised queries: cursor.execute(sql, params), PreparedStatement with ?, or FromSqlInterpolated / SqlParameter in .NET.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH020

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH020