no-unsafe-query

Prevent SQL injection by disallowing string concatenation or interpolated template literals in mysql/mysql2 queries.

CWE: CWE-89 OWASP: A03:2021 – Injection

Detects SQL injection in MySQL raw queries. This rule is part of eslint-plugin-mysql-security.

💼 This rule is set to error in the recommended config.

Quick Summary

Aspect	Details
CWE Reference	CWE-89 (SQL Injection)
Severity	Critical (CVSS 9.8)
Auto-Fix	❌ No auto-fix available
Category	Security

Rule Details

Reports three shapes when they reach a raw-SQL sink:

String concatenation — conn.query('SELECT ... ' + value)
Template interpolation — conn.query(`SELECT ... ${value}`)
A variable tainted by either, including via +=, then passed to a sink

Sinks

connection.query() and connection.execute() — the mysql2 prepared-statement API. .execute() is not a SQL-only method name, so a finding also requires a SQL keyword in the static text.

Because several of these are common method names outside MySQL, a finding additionally requires a SQL keyword (SELECT, INSERT, UPDATE, DELETE, FROM, WHERE, VALUES, …) in the static part of the string.

❌ Incorrect

await conn.query(`SELECT * FROM users WHERE id = ${userId}`);

await conn.query('SELECT * FROM users WHERE email = ' + email);

let sql = 'SELECT * FROM products WHERE 1=1';
sql += ` AND name = '${name}'`;
await conn.query(sql);

✅ Correct

conn.execute('SELECT * FROM users WHERE id = ?', [userId]);

Known limitations

Only identifier member access is matched, so conn['query'](...) is a false negative.
Taint tracking is single-scope and name-based — it does not follow a query string across function boundaries.

Implementation

The detection is shared across the driver plugins via createSqlInjectionRule in @interlace/eslint-devkit; this rule supplies MySQL's sinks and remediation copy. Install the plugin matching your stack and you get exactly one finding per line.