parameterized query
Keep SQL structure separate from input values.
Use this when A database query includes values supplied by a user.
without the term
“This search builds the SQL by gluing the user's text into the string. I've heard that's dangerous. Can you make it safe even if someone types weird characters or SQL?”
with the term · How do you ask a model for parameterized query?
Parameterize this query. Bind every user-supplied value, allowlist dynamic column names, and test an input containing SQL syntax.
What is parameterized query?
A parameterized query binds values separately from SQL syntax. Dynamic identifiers still need a controlled selection strategy.
Why does parameterized query matter when vibe coding?
String interpolation can turn an ordinary value into executable query syntax.
How do you do parameterized query?
Bind values and allowlist variable identifiers. Check that hostile input is treated as data.
What goes wrong with parameterized query?
Parameters are incorrectly expected to substitute table or column names.