Dynamic SQL String Interpolation or Concatenation Across Polyglot Drivers

Remediation checklist

• Go: pass static SQL with driver placeholders (? or $1) and separate variadic arguments to database/sql QueryContext/ExecContext; TypeScript & JavaScript: pass parameterized queries ('SELECT ... WHERE id = $1', [id]) instead of template literals.
• Python: pass DB-API placeholders (?, %s, :name) and a separate parameter tuple/dict to cursor.execute; Java & Kotlin: use PreparedStatement or JdbcTemplate with '?' bind parameters; C#: bind @p0 SqlParameter/DbParameter or EF Core ExecuteSqlInterpolated.
• Rust: use static query strings with sqlx::query(...).bind(val) or rusqlite params![val] instead of format!(...); C/C++ & Swift: use sqlite3_prepare_v2 + sqlite3_bind_text or PQexecParams instead of string concatenation or \(...) interpolation.
• Ruby: use ActiveRecord Hash conditions or '?' / ':name' bind placeholders (User.where('email = ?', email)) instead of "#{...}" interpolation; PHP: use PDO::prepare + execute([$val]) or mysqli::execute_query($sql, [$val]) instead of "$var" or '.' concatenation.
• For dynamic identifiers (table/column names or ORDER BY direction) where automatic extinguish declines, map caller keys through a strict switch/map allowlist returning compile-time constant SQL strings.

Illustrative Code Examples

These fragments explain migration direction. They are not complete applications or compiler-verified patches for your project.

// Go: fmt.Sprintf SQL interpolation
row := db.QueryRowContext(ctx, fmt.Sprintf("SELECT id FROM users WHERE email = '%s'", email))

# Ruby: ActiveRecord string interpolation
users = User.where("email = '#{params[:email]}'")

// PHP: PDO variable interpolation
$rows = $pdo->query("SELECT id FROM users WHERE email = '$email'");

// Go: bound placeholder
row := db.QueryRowContext(ctx, "SELECT id FROM users WHERE email = $1", email)

# Ruby: bound ActiveRecord placeholder
users = User.where("email = ?", params[:email])

// PHP: PDO prepared statement with bound parameter array
$stmt = $pdo->prepare('SELECT id FROM users WHERE email = ?');
$stmt->execute([$email]);