Replace string-built SQL with parameterized queries
Queries assembled by string concatenation, replaced with parameterised ones and a rule that blocks the pattern.
The ticket
Replace string-concatenated SQL with parameterised queries.
Acceptance criteria
- No query is built by string concatenation of user input
- Behaviour is unchanged, proven by existing tests
- A rule blocks the concatenation pattern from returning
- Dynamic identifiers are allowlisted rather than interpolated
What lands as proof
A rule failing on a seeded concatenation, plus unchanged tests proving the queries still behave the same.
Why teams defer it
- The code works and the injection is theoretical until somebody proves otherwise.
- Dynamic table or column names cannot be parameterised, so the fix needs a per-case decision.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: replace string-concatenated SQL with parameterised queries. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means tests plus a rule that blocks the old pattern returning, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.