Catching SQL Injection: VS Code Copilot and String-Interpolated Queries

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot is adding a user lookup query. It builds the SQL string with template literal interpolation:

const query = `SELECT * FROM users WHERE email = '${userEmail}'`;
db.execute(query);

SSG catches the write before it's saved — any unescaped user input in a SQL string is a direct injection vector.

# illustrative sample output
[BLOCK] write › src/db/users.ts — rule: no-sql-string-interpolation

Give SSG context

SSG evaluates VS Code Copilot's file write calls via the SSG MCP Server integration.

Required context

rule no-sql-string-interpolation {
  enabled true
  priority 100
  severity error
  DENY write
  IF content MATCHES "(SELECT|INSERT|UPDATE|DELETE).*\$\{[^}]+\}"
  MESSAGE "SQL query with string interpolation detected. Use parameterized queries to prevent SQL injection."
}

Optional context

Also catch Python f-string SQL patterns:

rule no-sql-fstring {
  enabled true
  priority 100
  severity error
  DENY write
  IF path ENDS_WITH ".py"
  AND content MATCHES "(SELECT|INSERT|UPDATE|DELETE).*f[\"'][^\"']*\{"
  MESSAGE "SQL query with f-string interpolation detected. Use parameterized queries."
}

What SSG does

SSG blocks the file write before the unsafe query is persisted. No database code with injection risk enters the codebase.

Ask the agent to use parameterized queries

SQL string interpolation was blocked. Use parameterized queries:

// Node.js / postgres example:
const result = await db.query(
  'SELECT * FROM users WHERE email = $1',
  [userEmail]
);

// Node.js / mysql2 example:
const [rows] = await db.execute(
  'SELECT * FROM users WHERE email = ?',
  [userEmail]
);
Parameterized queries separate SQL from data — user input can never alter the query structure.

Use an ORM as a defense-in-depth layer

ORMs (Prisma, TypeORM, Drizzle) generate parameterized queries automatically. If you must use raw SQL, use the query builder's tagged template functions:

// Prisma tagged template (safe)
const users = await prisma.$queryRaw`SELECT * FROM users WHERE email = ${userEmail}`;

Audit database queries over time

Review ssg dashboard for any write operations on files containing database query patterns. Track how frequently agents introduce raw SQL versus parameterized alternatives.