# Scanning embedded SQL calls / FN SQL Injection for Python

**URL:** <https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795>\
**Category:** SonarQube Cloud\
**Tags:** python, security, false-negative, sonarqube-cloud\
**Created:** [May 22, 2024, 10:37pm UTC](https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795 "2024-05-22T22:37:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sodul](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sodul/32/6385_2.png) [@sodul](https://community.sonarsource.com/u/sodul)\
**Post date:** [May 22, 2024, 10:37pm UTC](https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795/1 "2024-05-22T22:37:25Z")

</div>

We have a monorepo that embeds SQL query or PSQL, MSSQL, etc… from Python and Go code.

Once in a while a more Junior engineer will use string formatting to pass values to the SQL query instead of using the driver’s argument passing which is much safer.

Is this something that sonar can detect and alert on, or is the SQL scanning purely for independent SQL files?

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [May 28, 2024, 7:01am UTC](https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795/3 "2024-05-28T07:01:13Z")

</div>

Hello @sodul,

I suspect you want to detect SQL injection issues if tainted data is used to build an SQL query.  
Sonar can do that for Python if you have the SQ Developer Edition+ or if you use SonarCloud.  
The same feature [doesn’t exist yet for Go](https://portal.productboard.com/sonarsource/3-sonarqube/c/215-sast-for-go?&utm_medium=social&utm_source=starter_share), even if it is highly requested by other users.

Would you be able to share a snippet of Python + SQL to be sure we are talking about the same thing?

Thanks  
Alex

---

<div class="post-metadata">

**Author:** ![sodul](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sodul/32/6385_2.png) [@sodul](https://community.sonarsource.com/u/sodul)\
**Post date:** [May 29, 2024, 6:05am UTC](https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795/6 "2024-05-29T06:05:27Z")

</div>

Yes, we have SQL code embedded into our python code.

The sample code would be:

```python
        records = []
        with self.db.connection() as connection:
            with connection.cursor() as cursor:
                cursor.execute(
                    'select id, start_timestamp from records'
                    f' where org_id={org_id} and expired > NOW();'
                )
                for record in cursor.fetchall():
                    records.append(record)

```

Here I would expect Sonar to tell the developer to pass the `org_id` as a parameter to `cursor.execute()` as a way to prevent SQL injections.

We use SonarCloud on private repositories.

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [May 29, 2024, 7:06am UTC](https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795/7 "2024-05-29T07:06:12Z")

</div>

Hello,

I agree with you that if the `org_id` comes from a tainted input, the rule [S3649](https://rules.sonarsource.com/python/type/Vulnerability/RSPEC-3649/) should be raised.  
Also, you should have the Security Hotspot [python:S2077](https://rules.sonarsource.com/python/RSPEC-2077/) triggered to inform the developer that this is not a best practice to build SQL queries using concatenation. Can you check that in the Security Hotspots page?

It would be awesome if you could add your snippet of code to a reproducer (one single Python file) so we can investigate why S3649 is not raised. With what you shared, we can’t say because we have no visibility of where the `org_id` comes from.

Alex

---

<div class="post-metadata">

**Author:** ![sodul](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sodul/32/6385_2.png) [@sodul](https://community.sonarsource.com/u/sodul)\
**Post date:** [May 29, 2024, 8:21pm UTC](https://community.sonarsource.com/t/scanning-embedded-sql-calls-fn-sql-injection-for-python/115795/8 "2024-05-29T20:21:50Z")

</div>

I’ll see what I can do with regards to sharing a more comprehensive example. This is code on private repositories which I cannot share on a public forum.