Rule
Avoid SELECT * in SQL queries.
SELECT * in production code makes applications
fragile to schema changes and obscures data dependencies.

Supported languages: 45+

Introduction

Using SELECT * in production queries retrieves every column from a table, including columns your application doesn't use. When database schemas evolve and new columns are added (including sensitive data like passwords or PII), queries using SELECT * automatically start retrieving them without code changes. This creates security vulnerabilities and breaks assumptions in your application logic.

Why it matters

Performance impact: Retrieving unnecessary columns increases query execution time, network transfer size, and memory consumption. A table with 50 columns where you only need 5 means you're transferring 10x more data than necessary, degrading response times and increasing infrastructure costs.

Security implications: New columns added to tables (audit fields, internal flags, sensitive user data) are automatically exposed through SELECT * queries. Your API might start leaking password hashes, SSNs, or internal business data that was never intended for that endpoint.

Code maintainability: When SELECT * queries break after schema changes, the failure happens at runtime, not compile time. A new non-nullable column or renamed field causes production errors. Explicit column lists make dependencies clear and break builds when schemas change incompatibly.

Code examples

❌ Non-compliant:

async function getUserProfile(userId) {
    const query = 'SELECT * FROM users WHERE id = ?';
    const [user] = await db.execute(query, [userId]);

    return {
        name: user.name,
        email: user.email,
        createdAt: user.created_at
    };
}

Why it's wrong: This retrieves all columns including potentially sensitive fields like password_hash, ssn, internal_notes, or deleted_at. As the schema grows, this query becomes slower and exposes more data, yet the application only uses three fields.

✅ Compliant:

async function getUserProfile(userId) {
    const query = `
        SELECT name, email, created_at
        FROM users
        WHERE id = ?
    `;
    const [user] = await db.execute(query, [userId]);

    return {
        name: user.name,
        email: user.email,
        createdAt: user.created_at
    };
}

Conclusion

Always specify explicit column lists in SQL queries. This prevents data leaks, improves performance, and makes dependencies between code and schema clear. The small upfront cost of typing column names prevents entire classes of security and performance issues.