SQL Injection Risk Review of Query-Building Code (Defensive)
Check code that builds queries for unsafe patterns.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review application code that builds database queries for injection risk, so that I can fix my own code. Code excerpt with secrets removed: [CODE_EXCERPT]. Language and database library: [LANGUAGE_AND_LIBRARY]. Where the inputs come from (forms, URLs, files): [INPUT_SOURCES]. Identify places where user input is concatenated or formatted into query text, dynamic table or column names, dynamic ORDER BY, LIKE patterns, and stored procedures that build SQL. Explain in plain words why this is unsafe and show the safe pattern: parameterised queries or prepared statements, allow-lists for identifiers, and least-privilege database accounts. Provide corrected snippets and tests with ordinary inputs such as names containing apostrophes. Return a table with Location, Pattern, Risk and Fix and a checklist: parameters everywhere, restricted database permissions, error messages that do not reveal queries, logging without sensitive data. Do not provide attack strings or exploitation steps. Say clearly if the excerpt is too small to judge, and mark library syntax [VERIFY].
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.