Get Started
- CodeAnt AI
- Setup
- Control Center
- Pull Request Review
- IDE
- Compliance
- Anti-Patterns
- Code Governance
- Infrastructure Security Database
- Application Security Database
- Apex
- Bash
- C
- Clojure
- Cpp
- Csharp
- Dockerfile
- Elixir
- Fingerprints
- Generic
- Go
- Aws-lambda
- Gin
- Gorilla
- Gorm
- Grpc
- Command-injection
- Nosql
- Path-traversal
- Security
- Sql
- Grpc-pg-sqli-taint-med-conf
- Grpc-pg-sqli-taint
- Grpc-pgx-sqli-taint-med-conf
- Grpc-pgx-sqli-taint
- Grpc-vanillasql-format-string-sqli-taint-med-conf
- Grpc-vanillasql-format-string-sqli-taint
- Ssrf
- Jwt-go
- Lang
- Net
- Otto
- Secrets
- Template
- Html
- Java
- Javascript
- Json
- Kotlin
- Ocaml
- Php
- Problem-based-packs
- Python
- Ruby
- Rust
- Scala
- Solidity
- Swift
- Terraform
- Typescript
- Yaml
Grpc-pgx-sqli-taint-med-conf
Grpc pgx sqli taint med conf
Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Create parameterized queries in pgx by using positional parameters ($1, $2, …) and adding the values as additional arguments to the function call. It is also possible to create prepared statements through the Prepare function. This function uses the same placeholders for bound parameters.
Likelihood: HIGH
Confidence: MEDIUM
CWE:
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP:
- A01:2017 - Injection
- A03:2021 - Injection