Registry / devops / eslint-plugin-sql-injection

eslint-plugin-sql-injection

library1.0.2jsnpmunverified

ESLint plugin that detects string concatenation in SQL queries to prevent SQL injection vulnerabilities. Version 1.0.2 is the latest stable release, with sporadic updates. It analyzes function calls (default function name 'query') and flags any argument that uses string concatenation or template literals. Differentiates from other SQL security plugins by its simplicity and focus on concatenation patterns. Ideal for Node.js projects using raw SQL queries.

devops security

npm install eslint-plugin-sql-injection

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-SQL-

eslint-plugin-sql-injection

devopsjavascriptv1.0.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Plugin

✓ plugins: ['sql-injection']

✗ Using require('eslint-plugin-sql-injection') in .eslintrc.js without adding to plugins array

In ESLint config, add 'sql-injection' to plugins array, then enable rules prefixed with 'sql-injection/'

Rule no-sql-injection

✓ rules: { 'sql-injection/no-sql-injection': 'error' }

✗ rules: { 'no-sql-injection': 'error' } (missing prefix)

The rule name must include the plugin prefix.

Options

✓ rules: { 'sql-injection/no-sql-injection': ['error', { queryFunctionNames: ['q'] }] }

✗ Using invalid option names or wrong syntax

Options passed as second element of array; valid only 'queryFunctionNames'.

Shows how to configure and use the plugin to flag string concatenation in SQL queries.

// .eslintrc.js module.exports = { plugins: ['sql-injection'], rules: { 'sql-injection/no-sql-injection': 'error' } }; // Example code that triggers error: const query = 'SELECT * FROM users WHERE id = ' + userId; // error: SQL injection risk // Correct: use parameterized query const query = 'SELECT * FROM users WHERE id = ?'; connection.query(query, [userId]); // no error

Debug

Known issues

gotchaPlugin only checks function arguments; it does not detect all SQL injection vectors.

fix

Use parameterized queries or ORM; treat this as an additional guard, not comprehensive.

affects: >=0.0.0

gotchaRule expects function name 'query' by default; custom functions must be specified.

fix

Use 'queryFunctionNames' option to include your own database function names.

affects: >=0.0.0

gotchaDoes not support TypeScript or JSX natively; may not parse all ESLint parser extensions.

fix

Use '@typescript-eslint/parser' with additional configuration if needed.

affects: >=0.0.0

Errors

Common errors & fixes

Definition for rule 'sql-injection/no-sql-injection' was not found.

Missing or misspelled plugin in plugins array.

fix

Ensure 'sql-injection' is in plugins array: plugins: ['sql-injection']

ESLint couldn't find the plugin "eslint-plugin-sql-injection".

Package not installed.

fix

Run 'npm install eslint-plugin-sql-injection --save-dev'

Unexpected top-level property "plugins".

Using non-standard config format (e.g., .eslintrc.json without 'extends'? Actually plugins is valid). More likely, using old ESLint config format (e.g., .eslintrc without 'extends'? Actually plugins is top-level property since ESLint 3).

fix

Ensure you're using a valid config file (e.g., .eslintrc.js) and not a package.json without 'eslintConfig'.

Upgrade

Version history

1.0.2latest on npm

Audit

Dependencies

eslintrequiredpeer dependency; plugin runs as an ESLint rule

Agent activity

17 hits · last 30 days

node

Resources

githubhttps://github.com/gavinaiken/eslint-plugin-sql-injection ↗

packageeslint-plugin-sql-injection ↗

homepagehttps://github.com/gavinaiken/eslint-plugin-sql-injection#readme ↗