playrote.play.v1

llgoyal6/sql-string-buildingv1.3.0Public

Sql string building

Answers one question about a codebase: where does it build a SQL statement from a string rather than from parameters.

Read the full description

Parameterised queries have existed as long as SQL drivers have and almost every codebase uses them almost everywhere, so the bug is never the whole data layer, it is one forgotten place. Finds f-strings, .format(), %-interpolation and + concatenation producing SQL in Python; template literals with ${} inside a SQL string in JavaScript and TypeScript; fmt.Sprintf feeding a query in Go; + concatenation and String.format reaching createQuery, createStatement, executeQuery or prepareStatement in Java, Kotlin and Scala; and format! feeding a query in Rust. SQL is recognised by keyword shape - SELECT or INSERT or UPDATE or DELETE next to FROM, INTO, SET, WHERE, JOIN, VALUES or ORDER BY - never by what a variable is called, because the variable in the forgotten place is as likely to be called s as sql. Severity is decided by where the interpolated value comes from, which is the only part that tells a

  • Published 4 Sep 2026
  • Download 1
  • Needs rote 0.62.0+
  • Digest sha256:752123bf4583…
  • Reference lgoyal6/sql-string-building@1.3.0

Before you run it11 local tools

Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.

  • ○
    bashlocal tool

    Must be on your PATH when used. minimum version undeclared.

  • ○
    python3local tool

    Requires >=3.8.0. Run rote play inspect to check your host; unverified versions remain unknown.

  • ○
    findlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    greplocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    sedlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    sortlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    wclocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    trlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    catlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    mktemplocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

  • ○
    rmlocal tooloptional

    Must be on your PATH when used. minimum version undeclared.

Inputs2, 1 required

rote asks for these before running and shows the defaults it will use.

  • Rootroot

    Directory tree whose sources should be audited for SQL built by string interpolation

    requiredstringexample .custom value allowed
  • Depthdepth

    How many directory levels below root to search for source files

    optionalstringdefault 8example 3custom value allowed

What it changes

No write operations are declared in this version's manifest.

Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.

Runtime details
  • rote CLIversion 0.62.0 or newer
  • Servicesnone declared
  • Digestsha256:752123bf458335e6531c3bc5570eac3fd7a7f77fdda390722c4557f325ea1d03
  • Archive size43140 bytes
  • Published2026-09-04T04:33:09.409636+00:00
  • Published withrote 0.78.0

Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.

A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.