sql-injection-guard

Detect non-parameterized SQL and rewrite queries with bound parameters.

Updated Apr 12, 2026

Search Tags:#security #auditing #sql #orm #web-development #code-review #parameterization

Ready to run

npx skills add https://github.com/KILWA73/MiniSoc --skill sql-injection-guard

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sql-injection-guard
Source: https://github.com/KILWA73/MiniSoc/tree/main/.agents/skills/sql-injection-guard
Command: npx skills add https://github.com/KILWA73/MiniSoc --skill sql-injection-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditing database interactions for parameterized queries and ORM-native protection. Trigger when the user asks to "check this query", "audit database code", or "is this SQL safe?".

Core Features & Use Cases

Analyze raw SQL patterns to detect unsafe string concatenation and non-parameterized queries.
Enforce parameterization by rewriting queries to use bound parameters in the database driver (e.g., ? or $1 placeholders).
Validate ORM usage to ensure raw queries or unsafe ORM constructs are avoided.
Use Case: A developer asks to audit a piece of code for potential SQL injection risk in a Laravel or Django app and receive a safe version.

Quick Start

Run an audit on the provided query or code snippet and output a secure, parameterized rewrite with a brief vulnerability explanation.

Frequently Asked Questions about sql-injection-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit SQL queries for injection vulnerabilities in my code?▼

To audit SQL queries for injection vulnerabilities, the process detects non-parameterized queries and unsafe string concatenation in raw SQL and ORM usage. It then outputs secure, parameterized rewrites with bound parameters and brief vulnerability explanations.

What is the best way to check if a raw SQL query is safe from injection?▼

The best way to check if a raw SQL query is safe from injection is to enforce parameterization using bound placeholders like ? or $1. This approach replaces unsafe string concatenation and ensures the database driver securely handles inputs.

Does this SQL injection audit work with ORM frameworks like Laravel and Django?▼

Yes, this SQL injection audit works with ORM frameworks like Laravel and Django by validating ORM usage. It specifically checks for unsafe ORM constructs and raw query methods to ensure native protection is maintained across PHP, Node.js, and Python projects.

How do I rewrite unsafe SQL string concatenation to use parameterized queries?▼

To rewrite unsafe SQL string concatenation into parameterized queries, replace concatenated variables with bound parameter placeholders like ? or $1. This secures the query by letting the database driver handle input sanitization and outputs the corrected code.

When do I need to audit ORM usage for SQL injection risks?▼

You need to audit ORM usage for SQL injection risks when raw queries or unsafe ORM constructs are introduced into web and backend services. Even with ORMs, raw query methods can bypass native protection and create injection vulnerabilities if not parameterized.