[
  {
    "id": "SQL001",
    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE).*(?:['\"`]\\s*\\+|\\+\\s*['\"`]|fmt\\.Sprintf|%\\s*\\w+)",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL002",
    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE).*'%s'|'%s'.*(?:SELECT|WHERE)",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL003",
    "pattern": "SELECT.*\\$\\{|INSERT.*\\$\\{|UPDATE.*\\$\\{|DELETE.*\\$\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL004",
    "pattern": "query\\s*=\\s*['\"`][^'\"`]*['\"`]\\s*\\+|f['\"].*(?:SELECT|WHERE)",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL005",
    "pattern": "\\$[\"'](?:[^\"']*(?:SELECT|INSERT|UPDATE|DELETE|WHERE|FROM)[^\"']*)[\"']",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: C# string interpolation ($\"...\") in SQL",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL006",
    "pattern": "(?:rawQuery|rawSql|raw_query|execute|db\\.query)\\s*\\(\\s*['\"`].*\\$[{a-zA-Z]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: rawQuery / rawSQL / execute with string interpolation",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL007",
    "pattern": "(?:rawQuery|execSQL|executeQuery|execute)\\s*\\(\\s*['\"`][^'\"`,]*['\"`]\\s*\\.format\\s*\\(",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: rawQuery / rawSQL / execute with string interpolation",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL008",
    "pattern": "rawQuery\\s*\\(\\s*[\"'].*\\$[a-zA-Z{]",
    "flags": "",
    "category": "sql_injection",
    "description": "SQL injection: Kotlin rawQuery with string interpolation ($variable)",
    "language": [
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL009",
    "pattern": "(?:connection|ActiveRecord::Base\\.connection)\\.execute\\s*\\([^)]*#\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Ruby connection.execute with string interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL010",
    "pattern": "cursor\\.execute\\s*\\([^)]*\\.format\\s*\\(|cursor\\.execute\\s*\\([^)]*%s",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Django/Python cursor.execute with .format()",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL011",
    "pattern": "(?:mysqli_query|pg_query|mysql_query)\\s*\\([^,]+,\\s*['\"][^'\"]*['\"]?\\s*\\.\\s*\\$",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: PHP mysqli_query / pg_query with variable concatenation",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL012",
    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE)\\s[^'\"]*\\.\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: PHP mysqli_query / pg_query with variable concatenation",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL013",
    "pattern": "ORDER\\s+BY\\s+\\$\\{|ORDER\\s+BY.*['\"`]\\s*\\+\\s*\\w|GROUP\\s+BY\\s+\\$\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: dynamic ORDER BY / column name from user variable",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL014",
    "pattern": "`[^`]*(?:FROM|WHERE|ORDER BY|GROUP BY|SET)[^`]*\\$\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: template literal with SQL keywords and column/table variable",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL015",
    "pattern": "[\"'][^\"']*(?:SELECT|WHERE|FROM|DELETE|UPDATE)[^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: PHP dot-concat with SQL string (\"SELECT...\" . $var)",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL016",
    "pattern": "[\"']SELECT[^\"']*\\$[a-zA-Z_]|[\"']DELETE[^\"']*\\$[a-zA-Z_]|[\"']UPDATE[^\"']*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: PHP variable in double-quoted SQL string (\"SELECT * FROM $table WHERE $where\")",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL017",
    "pattern": "mysqli_query\\s*\\(\\s*\\$[a-zA-Z_]+\\s*,\\s*\\$[a-zA-Z_]|pg_query\\s*\\(\\s*\\$[a-zA-Z_]+\\s*,\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: mysqli_query / pg_query called with variable built by concat",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL018",
    "pattern": "\\.where\\s*\\(\\s*[\"'][^\"']*#\\{|\\.find_by_sql\\s*\\(\\s*[\"'][^\"']*#\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Ruby .where() or .find_by_sql() with string interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL019",
    "pattern": "[\"'](?:SELECT|DELETE|UPDATE|INSERT)[^\"']*#\\{[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Ruby string with SQL keywords and #{} interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL020",
    "pattern": "string\\.Format\\s*\\(\\s*[\"'][^\"']*(?:SELECT|WHERE|FROM|DELETE)[^\"']*[\"']",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: C# string.Format with SQL",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL021",
    "pattern": "(?:String\\s+\\w+|var\\s+\\w+)\\s*=\\s*[\"']SELECT[^\"']*[\"']\\s*\\+\\s*\\w",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Java/C# string variable assigned SQL with concat",
    "language": [
      "csharp",
      "java"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL022",
    "pattern": "cursor\\.execute\\s*\\(\\s*[\"'][^\"']*[\"']\\s*%\\s*\\(",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Python cursor.execute with % operator format",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL023",
    "pattern": "\\.extra\\s*\\(\\s*where\\s*=\\[[\"'][^\"']*%s",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Django .extra() with user-controlled where arg",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL024",
    "pattern": "(?:repository|connection|dataSource|sequelize|db)\\.query\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+\\s*\\w",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: TypeORM/Sequelize .query() with string concat",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL025",
    "pattern": "val\\s+\\w*[Ss]election\\w*\\s*=\\s*[\"'][^\"']*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "SQL injection: Kotlin rawQuery where selection string contains interpolated var",
    "language": [
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL026",
    "pattern": "new SqlCommand\\s*\\(\\s*(?:\"[^\"]*\"\\s*\\+|string\\.Format|\\$[\"'])",
    "flags": "i",
    "category": "sql_injection",
    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL027",
    "pattern": "\\.CommandText\\s*=\\s*(?:\"[^\"]*\"\\s*\\+|\\$[\"'])",
    "flags": "i",
    "category": "sql_injection",
    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL028",
    "pattern": "string\\.Format\\s*\\(\\s*[\"'][^\"']*(SELECT|INSERT|UPDATE|DELETE|WHERE)",
    "flags": "i",
    "category": "sql_injection",
    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL029",
    "pattern": "new SqlCommand\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+",
    "flags": "i",
    "category": "sql_injection",
    "description": "C# SQL injection: SqlCommand with string concat / interpolation / Format",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL030",
    "pattern": "\\.where\\s*\\(\\s*[\"'][^\"']*#\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL031",
    "pattern": "find_by_sql\\s*\\(\\s*[\"'][^\"']*#\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL032",
    "pattern": "ActiveRecord::Base\\.connection\\.execute\\s*\\(\\s*[\"'][^\"']*#\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL033",
    "pattern": "\\.order\\s*\\(\\s*[\"'][^\"']*#\\{",
    "flags": "i",
    "category": "sql_injection",
    "description": "Ruby SQL injection: ActiveRecord with string interpolation",
    "language": [
      "ruby"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL034",
    "pattern": "mysqli_query\\s*\\(\\s*\\$\\w+\\s*,\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL035",
    "pattern": "mysql_query\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL036",
    "pattern": "\\$pdo->query\\s*\\(\\s*[\"'][^\"']*[\"']?\\s*\\.\\s*\\$",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL037",
    "pattern": "\\$(?:query|sql)\\s*=\\s*[\"'][^\"']*(?:SELECT|INSERT|UPDATE|DELETE)[^\"']*[\"']?\\s*\\.\\s*\\$",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL038",
    "pattern": "(?:SELECT|INSERT|UPDATE|DELETE)[^\"'\\n]*\\$(?:_GET|_POST|_REQUEST|_COOKIE)\\[",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: mysqli_query / mysql_query / PDO",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL039",
    "pattern": "db\\.(?:Query|QueryRow|Exec)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
    "flags": "i",
    "category": "sql_injection",
    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL040",
    "pattern": "r\\.DB\\.(?:Query|QueryRow|Exec|ExecContext)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
    "flags": "i",
    "category": "sql_injection",
    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL041",
    "pattern": "h\\.DB\\.(?:Query|QueryRow|Exec)\\s*\\(\\s*fmt\\.Sprintf\\s*\\(",
    "flags": "i",
    "category": "sql_injection",
    "description": "Go SQL injection: db.Query/QueryRow/Exec with fmt.Sprintf",
    "language": [
      "go"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL042",
    "pattern": "[\"']\\s*EXEC\\s+\\w+\\s*['\"\"]\\s*\\+|EXEC\\s+sp_\\w+\\s*['\"\"]\\s*\\+",
    "flags": "i",
    "category": "sql_injection",
    "description": "C# SQL injection: EXEC stored procedure via string concat",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL043",
    "pattern": "\"EXEC\\s+sp_\\w+[^\"]*\"\\s*\\+|string sql\\s*=\\s*\"EXEC",
    "flags": "i",
    "category": "sql_injection",
    "description": "C# SQL injection: EXEC stored procedure via string concat",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL044",
    "pattern": "\"[^\"]*(?:SELECT|INSERT|UPDATE|DELETE)[^\"]*\\$[a-zA-Z_]\\w*[^\"]*\"",
    "flags": "i",
    "category": "sql_injection",
    "description": "Kotlin: SQL injection via string template with embedded interpolation",
    "language": [
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL045",
    "pattern": "\"\"\"\\.format\\s*\\(|'''\\.format\\s*\\(",
    "flags": "",
    "category": "sql_injection",
    "description": "Python: SQL injection via .format() on multi-line raw SQL string",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL046",
    "pattern": "\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE|[a-zA-Z_]\\w*)",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: appending user variable to existing query with .= operator",
    "language": [
      "php"
    ],
    "severity": "critical"
  },
  {
    "id": "SQL047",
    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "sql_injection",
    "description": "PHP SQL injection: SQL WHERE/SET clause with dot-concatenated variable",
    "language": [
      "php"
    ],
    "severity": "critical"
  }
]