PerlCritic policy that attempts to detect the most common sources of SQL injection in manually crafted SQL statements, by detecting the use of variables inside interpolated strings that look like SQL statements.
It will always look at the previous significant sibling, so it will also prevent false positives like:
do_something() or die "Select returned: $error";
do_something() or warn "Update returned: $error";
do_something() or croak "Insert returned: $error";
do_something() or carp "Delete returned: $error";
do_something() or confess "Select returned: $error";
Coverage decreased (-0.4%) to 96.622% when pulling 7d6b813e953f8e2711fbee8d207b9b8963936586 on nferraz:nferraz/prevent-false-positives into 13fa7f035842886ac80ceea1e3904398e7771e9b on guillaumeaubert:master.
This pull request will prevent false positives in contexts that cannot generate SQL injections, for instance:
It will always look at the previous significant sibling, so it will also prevent false positives like: