Audit SQL construction for concatenation and raw ORM

Do not trust that an ORM means no SQLi. Find string-built queries and raw escapes.

grep -rEn "SELECT .*+|f"SELECT|format(.*SELECT|.raw(|createQuery(|db.Query(fmt" --include=*.{py,java,js,ts,go,rb} .

The bug is input in the query text.

cur.execute("SELECT * FROM u WHERE name='%s'" % name)   # use parameters

Pro note: ORDER BY, LIMIT, column and table names cannot be parameterized, so those clauses are common injection points even in otherwise parameterized code. Also check dynamic IN lists and LIKE patterns where developers hand-build the string.