detecting-sql-injection-patterns

name	detecting-sql-injection-patterns
description	Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods (cursor.execute with % formatting), Knex / Sequelize raw() with template interpolation, sequelize.query with replacements. Use when: pre-commit code review, post-feature SQL-touching release, inheriting a legacy codebase that predates ORMs, or post-bug-report investigation. Threshold: any source line where SQL keywords (SELECT / INSERT / UPDATE / DELETE / FROM / WHERE) appear in a string that's being built via concatenation, f-string, %-format, or .format() with variable input. Trigger with: "scan for sqli", "sql injection patterns", "check raw queries", "audit cursor.execute".
allowed-tools	["Read","Bash(python3:*)","Glob","Grep"]
disallowed-tools	["Bash(rm:*)","Bash(curl:*)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","static-analysis","sql-injection","pentest"]

Detecting SQL Injection Patterns

Overview

SQL injection (CWE-89, OWASP A03:2021) remains one of the highest- impact and most-easily-introduced vulnerability classes. The fix is near-universal: use parameterized queries. The cause when introduced: an engineer concatenates user input into a SQL string because the ORM's parameterization mechanism wasn't obvious, or because they "just need to add a quick condition."

The scanner reads source files and grades each apparent SQL-string construction against the threshold table.

When the skill produces findings

Finding	Severity	Threshold	Affected control
f-string with SQL keywords + user input	CRITICAL	f"SELECT * FROM users WHERE id = {user_id}"	CWE-89
String concat into SQL keyword string	CRITICAL	"SELECT ... " + var + " ..."	CWE-89
%-format SQL string	HIGH	"SELECT * FROM %s" % table_name	CWE-89
.format() into SQL string	HIGH	"SELECT {} FROM users".format(col)	CWE-89
cursor.execute(f"...")	CRITICAL	f-string passed directly to cursor.execute	CWE-89
sequelize.query with template literal	HIGH	sequelize.query(\SELECT * FROM ${table}`)`	CWE-89
Knex / sequelize raw() with interpolation	HIGH	knex.raw('SELECT * FROM ' + table)	CWE-89
Django .extra() with raw SQL	MEDIUM	Model.objects.extra(where=['col = ' + val])	CWE-89
cursor.executemany with string-built query	CRITICAL	Same risk as execute	CWE-89
JDBC Statement.execute with concat