skills.rest
hung-phan
hung-phanCOMMUNITY
Explore all skills by this author →
GitHub

sqli

Identify and mitigate SQL injection vulnerabilities in production systems.

Updated Jun 5, 2026
Search Tags:#security#sql injection#orm#stored procedures#nosql#parameterized queries
One-click install
npx skills add https://github.com/hung-phan/system-skills --skill sqli-hung-phan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sqli
Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/sqli
Command: npx skills add https://github.com/hung-phan/system-skills --skill sqli-hung-phan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides guidance on defending against SQL injection vulnerabilities in production systems, helping developers write secure code and prevent data breaches.

Core Features & Use Cases

  • Parameterized Queries: Teaches the importance of using parameterized queries to prevent SQL injection.
  • ORMs and Dynamic Identifiers: Discusses the role of ORMs and how to handle dynamic identifiers safely.
  • Stored Procedures: Analyzes the limitations of stored procedures as a standalone defense against SQL injection.
  • NoSQL Injection: Offers insights into the risks of SQL injection in NoSQL databases.
  • Use Case: A developer can use this Skill to review and refactor their code to prevent SQL injection vulnerabilities.

Quick Start

Review your codebase for SQL injection vulnerabilities using the provided guidelines.

Frequently Asked Questions about sqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in production systems using parameterized queries?▼

Parameterized queries prevent SQL injection by separating SQL code from user-supplied data, ensuring input is treated strictly as values rather than executable code. This Skill provides guidelines for implementing them correctly to secure production databases.

Does using an ORM completely prevent SQL injection vulnerabilities?▼

ORMs mitigate many SQL injection risks by defaulting to parameterized queries, but they are not a complete defense. This Skill explains how to safely handle dynamic identifiers and outlines scenarios where ORM usage might still leave systems vulnerable.

Are stored procedures enough to stop SQL injection attacks?▼

Stored procedures offer limited protection against SQL injection and are not a standalone defense. This Skill analyzes their limitations, highlighting how improper implementation or dynamic SQL within procedures can still expose production systems to injection.

Can SQL injection attacks happen in NoSQL databases?▼

SQL injection risks extend to NoSQL databases through similar query manipulation vectors. This Skill offers insights into NoSQL injection risks, helping developers understand and mitigate vulnerabilities in non-relational data stores.

What is the best way to handle dynamic identifiers without causing SQL injection?▼

Handling dynamic identifiers safely requires strict validation and mapping untrusted input to a whitelist of allowed values. This Skill teaches secure techniques for dynamic identifiers to prevent injection when identifiers cannot be parameterized.

Related Skills

Explore More Software Engineering Skills→
dtsongdtsong
1

Schema Design

Design relational database schemas with normalization, indexes, and migration-ready SQL.

Community
Advanced
protofireprotofire
3

protofire-qa-agent

Audit smart contracts with Slither, Echidna, and Foundry fuzz testing.

Official
Advanced
Renzo-TognellaRenzo-Tognella

code-review

Automates code review for Ruby on Rails applications using static analysis tools.

Community
Advanced
Zhow01Zhow01
52

moltguard

Detect and block unsafe prompts and secret leakage in OpenClaw deployments.

Community
Intermediate