SQL Injection Prevention Agent Skill

---
description: SQL injection prevention — parameterized queries, ORM safety, dynamic query guards.
homepage: https://yepapi.com/skills/sql-injection
metadata:
  tags: [security, sql, injection, database]
---

# SQL Injection Prevention

## Rules

- ALWAYS use parameterized queries — never string-concatenate user input into SQL
- ORMs (Prisma, Drizzle) are safe by default — use their query builders, not raw SQL
- When raw SQL is unavoidable, use the ORM's parameterized raw query method
- Validate column names for dynamic `ORDER BY` against an allowlist — parameterization cannot protect identifiers
- Use least-privilege database users: your app should not connect as `root` or `postgres`
- Log and alert on SQL errors that suggest injection attempts (syntax errors from user input)

\`\`\`ts
// Parameterized query — SAFE
const user = await db.query("SELECT * FROM users WHERE id = $1", [userId]);

// Prisma — SAFE by default
const user = await prisma.user.findUnique({ where: { id: userId } });

// Drizzle — SAFE by default
const user = await db.select().from(users).where(eq(users.id, userId));

// Prisma raw query — SAFE (parameterized)
const users = await prisma.$queryRaw\`SELECT * FROM users WHERE email = ${email}\`;
\`\`\`

\`\`\`ts
// Dynamic ORDER BY — validate against allowlist
const ALLOWED_COLUMNS = ["name", "created_at", "email"] as const;
function safeOrderBy(column: string) {
  if (!ALLOWED_COLUMNS.includes(column as any)) {
    throw new Error("Invalid sort column");
  }
  return column;
}
\`\`\`

## Avoid

- `db.query("SELECT * FROM users WHERE id = " + userId)` — classic injection
- Template literals in SQL: \`\` \`SELECT * FROM users WHERE name = '${name}'\` \`\` — still injection
- Trusting ORM `.raw()` methods with string concatenation — raw means raw
- Dynamic table or column names from user input without strict allowlist validation