rules-prisma

Hardcoded database URL with credentials in schema.prisma will be committed to version control and exposed in CI logs. Use an environment variable reference: url = env("DATABASE_URL") and store the credential in .env (git-ignored) or a secrets manager.

$queryRawUnsafe passes the query string directly to the database driver with no parameterisation — SQL injection risk (CWE-89). Use Prisma.$queryRaw`SELECT ... WHERE id = ${id}` (tagged template) which automatically generates parameterised queries.

prisma.raw() was removed in Prisma 2.x. Replace with Prisma.sql`` tagged template literals used inside $queryRaw or $executeRaw. See the Prisma migration guide for raw query patterns.

String interpolation inside $executeRaw or $queryRaw with request/user data is a SQL injection vulnerability (CWE-89). Prisma only parameterises template literals when called as a tagged template with no concatenation. Use $queryRaw`SELECT ... WHERE id = ${Prisma.sql`${id}`}` or pass values as separate array parameters to $queryRawUnsafe (with full input validation).

$executeRawUnsafe executes a raw SQL string without any parameterisation — it is the most direct SQL injection vector in Prisma (CWE-89). Switch to $executeRaw with tagged-template parameters: prisma.$executeRaw`UPDATE ... SET x = ${value}` which Prisma parameterises automatically.