{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/sql-string-building@1.3.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Answers one question about a codebase: where does it build a SQL statement from a string rather than from parameters. Parameterised queries have existed as long as SQL drivers have and almost every codebase uses them almost everywhere, so the bug is never the whole data layer, it is one forgotten place. Finds f-strings, .format(), %-interpolation and + concatenation producing SQL in Python; template literals with \u0024{} inside a SQL string in JavaScript and TypeScript; fmt.Sprintf feeding a query in Go; + concatenation and String.format reaching createQuery, createStatement, executeQuery or prepareStatement in Java, Kotlin and Scala; and format! feeding a query in Rust. SQL is recognised by keyword shape - SELECT or INSERT or UPDATE or DELETE next to FROM, INTO, SET, WHERE, JOIN, VALUES or ORDER BY - never by what a variable is called, because the variable in the forgotten place is as likely to be called s as sql. Severity is decided by where the interpolated value comes from, which is the only part that tells a","distribution":{"digest":"sha256:752123bf458335e6531c3bc5570eac3fd7a7f77fdda390722c4557f325ea1d03","mediaType":"application/vnd.modiqo.rote-flow","size":43140,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0.json"},"name":"sql-string-building","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"Directory tree whose sources should be audited for SQL built by string interpolation","example":".","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":true,"type":"string"},{"default":"8","description":"How many directory levels below root to search for source files","example":"3","input":{"allowCustom":true,"choices":[],"label":"Depth"},"name":"depth","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/sql-string-building@1.3.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-04T04:33:09.409636+00:00","reference":"lgoyal6/sql-string-building@1.3.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["bash","python3","find","grep","sed","sort","wc","tr","cat","mktemp","rm"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":3,"names":["analyze","discover","verify"]},"title":"sql-string-building","type":"play","version":"1.3.0","visibility":"public"}