sql-security

Enforce parameterized queries and least-privilege credentials to prevent SQL injection.

Updated Dec 15, 2025

Search Tags:#security #auditing #sql #least-privilege #parameterized-queries #injection-prevention #orm-safety

Ready to run

npx skills add https://github.com/scruffydan/AI-Agents --skill sql-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sql-security
Source: https://github.com/scruffydan/AI-Agents/tree/main/source/skills/sql-security
Command: npx skills add https://github.com/scruffydan/AI-Agents --skill sql-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams prevent SQL injection, minimize database access risks, and enforce safe SQL practices across applications using raw SQL, query builders, or ORMs.

Core Features & Use Cases

Parameterized queries and prepared statements to prevent injection
Least-privilege access and secure authentication configurations
ORM safety and safe query construction for complex data access
Auditing and logging of risky queries and database operations
Use Case: review and harden code paths that build SQL from user input or rely on stored procedures

Quick Start

Review the project to identify unparameterized SQL and convert them to prepared statements.

Frequently Asked Questions about sql-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent SQL injection when building queries from user input?▼

Prevent SQL injection by using parameterized queries and prepared statements instead of string concatenation. This ensures user input is treated strictly as data rather than executable code, blocking injection attacks across raw SQL and ORM usage.

What is least-privilege access and how does it secure database authentication?▼

Least-privilege access restricts database credentials to only the permissions necessary for specific tasks. Configuring secure authentication and roles this way minimizes potential damage if a credential is compromised during a database operation.

How do I audit and log risky SQL queries in my application?▼

Audit risky SQL queries by implementing logging for database operations and unparameterized SQL. Reviewing these logs helps identify unsafe query construction from user input or stored procedures so they can be converted to prepared statements.

Does this approach work for securing stored procedures and database migrations?▼

Yes, securing stored procedures and migrations is part of enforcing safe SQL practices. The approach applies parameterized queries, input validation, and least-privilege credentials across code, deployments, and database configurations to minimize access risks.