T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
SQL Injection Through Unvalidated Identifiers and Query Fragments
- Content
View full analysis
'SQLBuilder': cols = ", ".join(columns) if columns else "*" self._query = f"SELECT {cols} FROM {self.table}" return self def where(self, condition: str, *params) -> 'SQLBuilder': self._query += f" WHERE {condition}" self._params.extend(params) return self def order_by(self, column: str, desc: bool = False) -> 'SQLBuilder': direction = "DESC" if desc else "ASC" self._query += f" ORDER BY {column} {direction}" return self def limit(self, n: int) -> 'SQLBuilder': self._query += f" LIMIT {n}" return self def join(self, table: str, on: str) -> 'SQLBuilder': self._query += f" JOIN {table} ON {on}" return self def insert(self, data: dict) -> 'SQLBuilder': cols = ", ".join(data.keys()) placeholders = ", ".join(["?"] * len(data)) self._query = f"INSERT INTO {self.table} ({cols}) VALUES ({placeholders})" self._params = list(data.values()) return self def update(self, data: dict) -> 'SQLBuilder': set_clause = ", ".join(f"{k} = ?" for k in data.keys()) self._query = f"UPDATE {self.table} SET {set_clause}" self._params = list(data.values()) return self def delete(self) -> 'SQLBuilder': self._query = f"DELETE FROM {self.table}" return self ``` ```python def create_table(self, name: str, columns: Dict[str, str], primary_key: str = "id") -> str: cols = [f"{primary_key} INTEGER PRIMARY KEY AUTOINCREMENT"] for col_name, col_type in columns.items(): cols.append(f"{col_name} {col_type}") query = f"CREATE TABLE IF NOT EXISTS {name} ({', '.join(cols)})" self.execute(query) return query ``` ```python for table in tables: table_name = table["name"] columns = self.execute(f"PRAGMA table_info({table_name})") ...[truncated 3494 chars]- Remediation
View remediation