SQL Injection Prevention Checklist
Review parameterized queries, escaping boundaries, ORM raw SQL, logging and testing habits that reduce SQL injection risk. This Formalint reference is written for working developers, DBAs and support engineers who need a repeatable debugging path instead of a one-line snippet with no context.
Use the notes below as a practical review order: understand the input, capture evidence, make one small change and verify the result before moving to the next assumption.
When to use this page
Keep SQL cleanup separate from SQL injection prevention. It is most useful when a small validation or debugging mistake can create noisy tickets, misleading logs or hard-to-review production changes.
Practical workflow
| Step | What to confirm |
|---|---|
| Bind values | Use prepared statements or framework parameters instead of string concatenation. |
| Review raw SQL | ORM escape hatches deserve the same attention as hand-written queries. |
| Keep logs safe | Do not log secrets or full user-provided payloads while debugging security cases. |
Parameterized query shape
-- Good shape: values are bound, not concatenated
SELECT id, email
FROM users
WHERE email = ?;Review checklist
- Never build WHERE clauses by concatenating user input.
- Validate identifiers separately from values.
- Use least-privilege database accounts.
- Add tests for quotes, comments and unexpected operators.
- Treat formatting tools as readability helpers, not security controls.
Common mistake
A formatted SQL string can still be injectable. Formatting improves review; parameter binding changes execution safety.
Formalint is strongest when the page helps the developer decide what the tool cannot prove. Treat every formatter, regex and command as one layer of evidence, not the whole truth.
Frequently asked questions
Can escaping alone prevent SQL injection?
Escaping is easy to get wrong. Parameterized queries are the normal safer default.
Are ORMs always safe?
No. Raw query APIs and dynamic identifiers still need careful review.
Related Formalint references
Continue with SQL Cleanup, HTTP Security Headers Checklist, Developer Data Validation.