rules-sql

Removing a column is irreversible. Ensure all application code no longer references it before applying.

TRUNCATE permanently deletes all rows and cannot be rolled back in some databases. Confirm this is intentional.

DELETE without a WHERE clause removes all rows. Add a WHERE condition or use TRUNCATE explicitly.

Destructive table removal without IF EXISTS will fail loudly if the table does not exist. Use IF EXISTS to make migrations idempotent.

RISK: GRANT ALL ON *.* grants the target account full DDL+DML rights — a single compromised credential equals full database takeover. FIX: Grant only the minimum required privileges on specific tables.

RISK: SQL built by template literal interpolation is a direct SQL injection sink (CWE-89). FIX: Use parameterized queries (? or placeholders with a bound params array) and never interpolate user data into SQL strings.

RISK: SQL built with an f-string is a direct SQL injection sink (CWE-89). FIX: Pass bound parameters as the second argument to cursor.execute() using %s or ? placeholders — never build queries via f-strings.

UPDATE without a WHERE clause modifies every row. Add a WHERE condition to target specific rows.

RISK: A commented-out WHERE clause on a mutating statement suggests the filter was intentionally disabled — a common source of full-table accidents. FIX: Restore the WHERE clause or remove the statement if it is no longer needed.