skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

sql-injection-prevention

Identify and fix SQL injection vulnerabilities in data access layers.

Updated Mar 29, 2026
Search Tags:#security#injection#sql#code-review#data-access#parameterized-queries#orm-safety
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill sql-injection-prevention-marquesfelip
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sql-injection-prevention
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/sql-injection-prevention
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill sql-injection-prevention-marquesfelip

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SQL injection remains one of the most dangerous vulnerabilities in data access layers. This skill provides proven patterns to enforce safe query construction, parameterized queries, and ORM safety to prevent injection across languages and data stores.

Core Features & Use Cases

  • Enforces parameterized queries for raw SQL, query builders, and ORMs.
  • Promotes safe dynamic identifiers via allowlists and database privilege hardening.
  • Offers practical checks and examples for common frameworks and database types (SQL, NoSQL, LDAP).

Quick Start

Audit your data access code and replace unsafe string concatenations with parameterized queries.

Frequently Asked Questions about sql-injection-prevention

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection vulnerabilities in my data access layer?▼

Prevent SQL injection in your data access layer by enforcing parameterized queries for raw SQL and ensuring safe ORM usage, replacing unsafe string concatenation with secure parameter binding across web services and microservices.

What is the best way to secure dynamic SQL identifiers without string concatenation?▼

Secure dynamic SQL identifiers by using strict allowlists that validate column and table names, ensuring that only pre-approved identifiers are dynamically inserted into queries rather than raw user input.

Does this approach to SQL injection prevention work with both raw SQL and ORM frameworks?▼

Yes, this SQL injection prevention approach works across raw SQL, ORM-based queries, and dynamic query builders, applying parameter binding and safe ORM usage to protect web services, batch jobs, and microservices.

How do I audit existing code for SQL injection risks during a code review?▼

Audit existing code for SQL injection risks by reviewing data access layers for unsafe string concatenations, verifying that parameterized queries are enforced, and checking ORM usage for safe query construction patterns.

Can I use parameterized queries to secure NoSQL and LDAP data stores?▼

Yes, parameterized query patterns extend to securing NoSQL and LDAP data stores, applying safe parameter binding techniques to prevent injection vulnerabilities beyond standard SQL databases.

Why should I harden database user privileges to prevent SQL injection?▼

Hardening database user privileges limits the blast radius of a successful SQL injection attack by restricting the database user's permissions, preventing unauthorized data modification or administrative access.

Related Skills

Explore More Software Engineering Skills→
EIS-ITSEIS-ITS

Backend Queries

Generate secure, optimized database queries with parameterized statements, eager loading, indexing, and transactions.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

securing-aws-iam-permissions

Automate AWS IAM hardening with least privilege, MFA, and credential rotation.

Community
Advanced
KILWA73KILWA73

sql-injection-guard

Detect non-parameterized SQL and rewrite queries with bound parameters.

Community
Advanced
ArianHobson333ArianHobson333
7

sql-injection

Identify SQL injection vulnerabilities in source code via taint analysis.

Community
Advanced