137
SQL injection
User input becomes part of the query string. Bind parameters. Do not concatenate.
What is SQL injection?
Injection is data interpreted as code. In SQL it is a quote that closes the string and adds a statement. The fix is parameterized queries. An ORM does not save you if you pass a raw fragment.
Why does SQL injection matter when vibe coding?
Models build a query by pasting the user string inside quotes because it looks like a tutorial. Name bind parameters every time a query is touched.
How do you do SQL injection?
Placeholders for every value. Identifiers (column names) come from an allowlist, never from the request. Tests include a quote in the input.
How do you ask a model for SQL injection?
Use bound parameters for every value in (query). Do not concatenate or interpolate user input into SQL. If a column name is dynamic, allowlist it. Add a test input that contains a quote.
What goes wrong with SQL injection?
Escaping quotes by hand. One dialect’s escape is another dialect’s bug. Bind.