Audit advanced Works with: Any AI

SQL Injection Risk Review for Query-Building Code

Checklist

• 🗄️ SQL

Defensive review of your own application code that builds SQL, finding string concatenation, risky inputs and the safe parameterised fix.

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.

Act as a defensive code reviewer. I will paste code from my own application that builds or runs SQL queries: [CODE_SNIPPETS]. Language and database library: [LANGUAGE_AND_LIBRARY]. Inputs that come from users, files, URLs or other systems: [INPUT_SOURCES]. The database account used by the app has these rights: [DB_ACCOUNT_RIGHTS].

Review for ways untrusted input could change the meaning of a query. Report: 1) A findings table with the columns File or function, Line, Pattern (string concatenation, formatted string, dynamic table or column name, dynamic ORDER BY, stored procedure with dynamic SQL, LIKE patterns), Input source and Severity (High, Medium, Low). 2) For each finding, a corrected version using parameterised queries or a safe allow-list for identifiers, with a short comment. 3) Counts of queries reviewed, safe, and risky. 4) A review of the database account rights against least privilege, with suggestions. 5) A short checklist for future code reviews, and a list of automated checks the team could add.

Scope and limits: this is defensive review of code that I own. Do not give attack strings, payloads or instructions for exploiting systems. If you cannot see where a value originates, mark the finding [VERIFY] and ask. Library methods and escaping functions differ between libraries and versions, so check against the official documentation for [LANGUAGE_AND_LIBRARY]. This is not a full security assessment; recommend a qualified review for anything handling sensitive data.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.