PHP SQL Fixer

Detect SQL injection risks and generate parameterized query fix patches for PHP/Yaf projects.

Overview

This skill does two things:

1. Scan — find all SQL injection candidates in a PHP project (string concatenation, superglobal interpolation, unsafe sprintf)
2. Fix — for each finding, generate the parameterized equivalent and explain the change

Always prefer minimal, targeted fixes. Do not refactor surrounding code. Do not change DB abstraction patterns that already exist in the project.

Workflow

Step 1 — Run the scanner