How to fix SQL Injection (Legacy & Modern)
in Salvo
Executive Summary
Salvo's performance is irrelevant if your database is an open book. SQL Injection in Rust usually stems from developers bypassing the type system to 'quickly' format strings into queries. Whether you are using raw drivers or modern async crates like sqlx, concatenating user input into SQL is a critical failure. This guide covers the transition from dangerous string formatting to secure, type-safe parameterized queries.
The Vulnerable Pattern
#[handler] async fn get_user_legacy(req: &mut Request, res: &mut Response) { let user_id = req.query::("id").unwrap_or_default(); // CRITICAL VULNERABILITY: String interpolation allows OOB access and logic bypass let query = format!("SELECT secret_data FROM users WHERE id = '{}'", user_id); let row: (String,) = sqlx::query_as(&query) .fetch_one(&pool) .await .unwrap(); res.render(row.0);
}
The Secure Implementation
The vulnerable example uses `format!` to build a query string. An attacker could pass `id=1' OR '1'='1` to dump the entire table. The secure version utilizes `sqlx` prepared statements. By using placeholders ($1, ?, or :name depending on the DB), the database driver sends the query structure and the data in separate packets. The SQL engine never parses the input as executable code. Furthermore, using the `sqlx::query!` macro provides compile-time verification, ensuring your queries are syntactically correct and type-safe before the binary is even built.
#[handler] async fn get_user_modern(req: &mut Request, res: &mut Response) { let user_id = req.query::("id").unwrap_or(0); // SECURE: Using bind parameters ($1) ensures input is treated strictly as data let row = sqlx::query!("SELECT secret_data FROM users WHERE id = $1", user_id) .fetch_one(&pool) .await; match row { Ok(record) => res.render(record.secret_data), Err(_) => res.status_code(StatusCode::NOT_FOUND), }
}
Your Salvo API
might be exposed to SQL Injection (Legacy & Modern)
74% of Salvo apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.