Sql Injection Prevention

Covers the fundamentals of preventing SQL injection with prepared statements, parameterized queries, and input validation across multiple stacks. Includes working examples for Node.js with PostgreSQL, Python with SQLAlchemy, and Java JDBC, plus a dedicated guide on input sanitization. The do's and don'ts are straightforward: always use prepared statements, never concatenate user input into queries, whitelist dynamic values when you absolutely need them. If you're writing database code or reviewing legacy systems for vulnerabilities, this gives you the patterns to lock things down. The reference implementations are practical enough to adapt directly into your codebase.

skills.sh installs: 533
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill sql-injection-prevention --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implement comprehensive SQL injection prevention using prepared statements, parameterized queries, ORM best practices, and input validation.

When to Use

Database query development
Legacy code security review
Security audit remediation
API endpoint development
User input handling
Dynamic query generation

Quick Start

Minimal working example:

// secure-db.js
const { Pool } = require("pg");

class SecureDatabase {
  constructor() {
    this.pool = new Pool({
      host: process.env.DB_HOST,
      database: process.env.DB_NAME,
      user: process.env.DB_USER,
      password: process.env.DB_PASSWORD,
      max: 20,
      idleTimeoutMillis: 30000,
      connectionTimeoutMillis: 2000,
    });
  }

  /**
   * ✅ SECURE: Parameterized query
   */
  async getUserById(userId) {
    const query = "SELECT * FROM users WHERE id = $1";
    const values = [userId];

SKILL.md on GitHub