# SQL Injection Detection

> Detects SQL injection vulnerabilities where user input is concatenated into SQL queries

- Skill: `zakirkun/sql-injection-detection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/sql-injection-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/sql-injection-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/sql-injection-detection

---


# SQL Injection Detection

## Overview
SQL injection occurs when user-controlled input is incorporated into SQL queries without proper sanitization or parameterization.

## Detection Strategy
1. **Import check**: Look for database packages (database/sql, gorm, sqlx)
2. **Call check**: Find SQL execution functions (Query, Exec, Raw)
3. **Context check**: Check if arguments include string concatenation or fmt.Sprintf
4. **Taint check**: Trace if user input reaches SQL execution sinks

## Remediation
Use parameterized queries / prepared statements instead of string concatenation.

**Vulnerable:**
```go
db.Query("SELECT * FROM users WHERE id = " + userInput)
```

**Safe:**
```go
db.Query("SELECT * FROM users WHERE id = $1", userInput)
```