SQL Injection Slipstream

What it is

User-controlled input appears to reach raw or dynamically composed SQL execution without parameterization evidence.

This usually appears when request-shaped data moves through helper functions until the original trust boundary is no longer obvious.

How to fix it

Use parameterized queries or ORM-safe APIs, remove raw SQL string concatenation, and add regression tests with malicious input.

1. 1Replace string-composed SQL with parameterized queries or ORM-safe APIs.
2. 2Remove raw concatenation of request data into query text.
3. 3Add regression tests that send malicious input at every query path.

How VibeAudit checks for this

VibeAudit checks this with scoped evidence from supported structural checks, external observations, and authorized probes where available. The free tier may show the surface name only, without private evidence or remediation details. Metadata-only surface maps do not create missing-control findings. Unsupported private repositories, authenticated behavior, destructive workflows, account configuration, and business logic remain unverified unless the scan includes matching local, imported, or authorized runtime evidence.

Related failure modes