# Replace string-built SQL with parameterized queries

Queries assembled by string concatenation, replaced with parameterised ones and a rule that blocks the pattern.

Category: Data layer and migrations
Source: https://letsship.ai/use-cases/replace-string-built-sql
Published: 2026-08-25

## Goal

Replace string-concatenated SQL with parameterised queries.

## Acceptance criteria

- No query is built by string concatenation of user input
- Behaviour is unchanged, proven by existing tests
- A rule blocks the concatenation pattern from returning
- Dynamic identifiers are allowlisted rather than interpolated

## What lands as proof

A rule failing on a seeded concatenation, plus unchanged tests proving the queries still behave the same.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Parameterise the SQL in {module}

Description: Replace string-concatenated SQL with parameterised queries.

Acceptance criteria:
- No query is built by string concatenation of user input
- Behaviour is unchanged, proven by existing tests
- A rule blocks the concatenation pattern from returning
- Dynamic identifiers are allowlisted rather than interpolated

Before you create the issue, search this repository for SQL assembled by concatenation and replace {module} with the worst area.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: replace string-concatenated SQL with parameterised queries. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means tests plus a rule that blocks the old pattern returning, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.