| name | detecting-sql-injection-vulnerabilities |
| description | Detect and analyze SQL injection vulnerabilities in application code and database queries.
Use when you need to scan code for SQL injection risks, review query construction, validate input sanitization, or implement secure query patterns.
Trigger with phrases like "detect SQL injection", "scan for SQLi vulnerabilities", "review database queries", or "check SQL security".
|
| allowed-tools | Read, Write, Edit, Grep, Glob, Bash(code-scan:*), Bash(security-test:*) |
| version | 1.31.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| tags | ["security","database","detecting-sql"] |
| compatibility | Designed for Claude Code |
Detecting SQL Injection Vulnerabilities
Overview
Scan application source code for SQL injection vulnerabilities (CWE-89, OWASP A03:2021) by tracing user input from entry points through data flows into database query construction. Detect string concatenation, format string interpolation, and inadequate parameterization across raw SQL, ORM raw query methods, stored procedure calls, and dynamic query builders.
Prerequisites
- Application source code accessible in
${CLAUDE_SKILL_DIR}/
- Database query files, ORM models, and repository/DAO layers available
- Framework and language identified (Django, Rails, Express, Spring, Laravel, ASP.NET, Go, etc.)
- Database type known (MySQL, PostgreSQL, SQLite, MSSQL, Oracle) for syntax-specific detection
- Write permissions for reports in
${CLAUDE_SKILL_DIR}/security-reports/
Instructions
- Discover database interaction code: search for SQL keywords (
SELECT, INSERT, UPDATE, DELETE, EXEC) and ORM raw query methods (raw(), execute(), createNativeQuery(), $wpdb->query()) across all source files.
- Identify input surfaces: map all user-controllable data entry points -- HTTP parameters, request bodies, URL path segments, headers, cookies, file uploads, and WebSocket messages.
- Trace data flows: follow each input surface through the code to determine whether user data reaches a SQL query. Flag any path where input is not passed through parameterized query binding.
- Detect vulnerable patterns:
- String concatenation:
"SELECT * FROM users WHERE id=" + userId
- f-string/format interpolation: Python f-strings embedding variables directly into SQL strings
- Template literals:
`SELECT * FROM users WHERE id=${req.params.id}`
- ORM raw queries without bindings:
Model.objects.raw("SELECT * FROM t WHERE x='" + val + "'")
- Classify each finding: assign CVSS 3.1 score, identify attack type (classic injection, blind boolean/time-based, UNION-based exfiltration, second-order/stored injection), and document exploitability (authentication required, network access).
- Assess impact per finding: determine data exposure scope (authentication bypass, data exfiltration, data modification, OS command execution via or ).
