SQL Injection Prevention

When to use

• The user reviews or fixes code for a SQL injection vulnerability, including dynamic ORDER BY, LIKE, or IN clauses.
• The user wants to replace string-concatenated SQL with prepared statements and bound parameters in PDO or mysqli.
• The user builds a SQL query that includes request, form, or API input and must stop SQL injection.

When NOT to use

• Do not use this skill when there is no SQL database — pure NoSQL, key-value, or in-memory stores have different injection models (e.g. NoSQL operator injection).
• Do not apply this skill to a fully static query with no variable input; a fixed string literal with no interpolation cannot be injected.