# ORM Raw Query Injection

> Detects raw SQL queries embedded within ORM frameworks that bypass parameterization, reintroducing SQL injection risk.

- Skill: `zakirkun/orm-raw-query-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/orm-raw-query-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/orm-raw-query-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/orm-raw-query-injection

---


# ORM Raw Query Injection

## Overview
ORM frameworks like SQLAlchemy, Hibernate, Sequelize, and GORM provide parameterized query builders that prevent SQL injection. However, they also expose `raw()`, `execute()`, and `query()` escape hatches that, when used with string concatenation or f-strings, reintroduce SQL injection vulnerabilities.

## Remediation
Use the ORM's parameterized query API instead of raw query methods.

**Vulnerable (Python/SQLAlchemy):**
```python
db.execute(f"SELECT * FROM users WHERE username = '{username}'")
```

**Safe (Python/SQLAlchemy):**
```python
db.execute(text("SELECT * FROM users WHERE username = :username"), {"username": username})
```