Results for “soql-injection”

SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.

Write and debug SOQL queries covering SELECT syntax, filters, sorting, pagination, relationship traversal, and aggregate functions.

Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.

Detect and exploit SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.

Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap.

Optimize SQL queries, indexes, and database performance across MySQL, PostgreSQL, SQL Server, and Oracle with execution plan analysis and universal tuning techniques.

Write SOQL queries that group or filter records by date periods using the 13 SOQL date functions, with rules for WHERE vs GROUP BY placement, date-literal comparisons, and fiscal-year restrictions.

Tests APIs for injection vulnerabilities including SQL, NoSQL, OS command, LDAP, and SSRF through parameters, headers, and request bodies.

Connect to PostgreSQL, MySQL, SQLite, and SQL Server databases using SQLAlchemy, Pandas, and DuckDB. Read and write tables, manage sessions, and handle connection strings securely.

Use when debugging slow SQL queries, designing database indexes, or rewriting queries for better performance. For EXPLAIN analysis, index strategy, N+1 problem resolution, and query optimization patterns.

Translates natural language data intents into syntactically valid Perfetto SQL queries and executes them against a local trace file using trace_processor.

Creates and manages Cloud SQL instances, databases, and users for MySQL, PostgreSQL, and SQL Server using gcloud CLI commands.

Performs comprehensive SQL code review across all major databases, analyzing security, performance, maintainability, and anti-patterns.

Creates an integration testing plan for .NET data access artifacts during Oracle-to-PostgreSQL database migrations, analyzing a project to identify repositories, DAOs, and service layers that interact with the database, then producing a structured testing plan.

Guides database index selection, creation, and maintenance with SQL examples for PostgreSQL and MySQL.

Provides PostgreSQL query patterns covering SELECT, JOINs, subqueries, CTEs, window functions, and advanced SQL techniques.

Analiza datos en bases de datos relacionales con consultas SQL eficientes y legibles, incluyendo joins, window functions, CTEs y subqueries, para extraer insights directamente de la base de datos.

Drizzle Raw SQL

Use for writing, reviewing, debugging, migrating, or testing SQLAlchemy 2.x Core or ORM code involving Engine, Connection, Session, mapped models, select statements, transactions, pooling, results, loading, or AsyncSession. Do not use for raw database SQL with no SQLAlchemy boundary, Alembic migration design, DuckDB relations, or database administration.

SQL patterns for database querying and design

Secure Go backend services against common vulnerabilities. Use when implementing input validation, crypto, or SQL injection prevention in Go.

SQLAlchemy Python SQL toolkit and ORM with powerful query builder, relationship mapping, and database migrations via Alembic

Microsoft SQL Server T-SQL procedural language. Covers stored procedures, functions, triggers, error handling, and SQL Server-specific features. Use for SQL Server database server-side programming. USE WHEN: user mentions "tsql", "T-SQL", "SQL Server procedures", "SQL Server functions", "TRY...CATCH", "THROW", "sp_executesql", "SSMS" DO NOT USE FOR: basic SQL Server SQL - use `sqlserver` instead, PostgreSQL - use `plpgsql` instead, Oracle - use `plsql` instead

Enforces SQL quality gates after every implementation: lint with SQLFluff, validate migrations with Flyway or Liquibase, and run database tests with pgTAP or equivalents.

Documents MariaDB-specific INSERT syntax and behavior, including RETURNING, ON DUPLICATE KEY UPDATE, INSERT IGNORE, and various forms and modifiers, to help write and review INSERT statements.

MySQL relational database. Covers queries, indexes, and optimization. Use when working with MySQL databases. USE WHEN: user mentions "mysql", "mariadb", asks about "AUTO_INCREMENT", "ON DUPLICATE KEY UPDATE", "GROUP_CONCAT", "mysql specific syntax" DO NOT USE FOR: PostgreSQL - use `postgresql` instead, MongoDB - use `mongodb` instead, Oracle - use `oracle` instead, SQL Server - use `sqlserver` instead

Execute SQL on a Databricks SQL Warehouse

Generates and reviews MariaDB CREATE SEQUENCE statements with version-specific syntax, defaults, and gotchas.

Quick reference for PostgreSQL best practices covering indexing, schema design, query optimization, and security defaults.

Oracle Database guidance for SQL, PL/SQL, SQLcl, ORDS, administration, app development, performance, security, migrations, and agent-safe database workflows. Use when the user asks to write, edit, rewrite, review, format, debug, tune, or explain SQL; create or refactor PL/SQL; use SQLcl, Liquibase, ORDS, JDBC, node-oracledb, Python, Java, .NET, or database frameworks; troubleshoot queries, sessions, locks, waits, indexes, optimizer plans, AWR, ASH, migrations, schemas, users, roles, privileges, backup, recovery, Data Guard, RAC, multitenant, containers, monitoring, auditing, encryption, VPD, or safe agent database operations.

Run a read-only SQL query against a SQLite database file

Perform create, read, update, and delete operations in MongoDB, covering query and update operators, atomic operations, and bulk writes.

Kysely type-safe SQL query builder - End-to-end type safety from schema to queries, migrations, transactions, plugins