- Home
- The 17 checks
- User input may be pasted into a SQL query
User input may be pasted into a SQL query
In plain English: Text someone types into your app is being glued straight into a database command. A person can type something crafted that your database runs as a command of its own, such as reading or deleting data. This is called SQL injection.
What happens if you ship it
Someone types a crafted value into a form and your database runs it as a command.
How to fix it technical
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Fix this problem in my project: User input may be pasted into a SQL query. Use a parameterised query. Pass values as parameters and never build SQL with template strings. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as sql-string-concat, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
What is SQL injection?
A way to trick a database into running commands by typing them into a form or a link. It happens when an app builds database commands by joining text together.
How do I prevent SQL injection?
Use parameterised queries, where the command and the values are sent separately, or a query builder that does it for you. Never build SQL with template strings.