preventing-sql-injection

Enforce parameterized Prisma raw SQL with $queryRaw tagged templates.

Updated Nov 21, 2025

Search Tags:#security #sql-injection #prisma #raw-sql

Ready to run

npx skills add https://github.com/djankies/claude-configs --skill preventing-sql-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: preventing-sql-injection
Source: https://github.com/djankies/claude-configs/tree/main/prisma-6/skills/preventing-sql-injection
Command: npx skills add https://github.com/djankies/claude-configs --skill preventing-sql-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enforces safe SQL construction in Prisma by using $queryRaw with tagged templates instead of $queryRawUnsafe, preventing SQL injection.

Core Features & Use Cases

Safe Raw SQL: Parameterized queries via tagged templates.
Safe Composition: Use Prisma.sql for dynamic AND safe query composition.
Threat Scenarios: Guard against injecting user input into SQL strings.

Quick Start

Replace any $queryRawUnsafe usage with $queryRaw... and validate with Prisma.sql composition where needed.

Frequently Asked Questions about preventing-sql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent SQL injection attacks in Prisma?▼

Prevent SQL injection in Prisma by using $queryRaw with tagged templates instead of $queryRawUnsafe. Tagged templates automatically parameterize values, separating SQL structure from user input so attackers cannot alter query logic through malicious strings.

Can I use dynamic SQL with Prisma without risking injection?▼

Yes. Use Prisma.sql for safe dynamic query composition. It parameterizes values while letting you build queries conditionally—for dynamic filters, IN clauses, or pagination—without concatenating untrusted input into SQL strings.

What's the difference between $queryRaw and $queryRawUnsafe in Prisma?▼

$queryRaw enforces parameterized queries via tagged templates, blocking injection; $queryRawUnsafe concatenates strings directly, leaving your database exposed. Replace all $queryRawUnsafe calls with $queryRaw tagged templates.

How do I safely handle user input in Prisma raw SQL queries?▼

Pass user input as template values in $queryRaw`...` or compose queries with Prisma.sql. Never interpolate user data into SQL strings. For identifiers like column or table names, maintain strict allowlists and validate against them before building queries.

Does Prisma 6 support parameterized queries for raw SQL?▼

Yes. Prisma 6 supports parameterized raw SQL through $queryRaw tagged templates and Prisma.sql composition. Both enforce parameter separation and prevent injection in TypeScript and JavaScript backend codebases.