SQL Injection in Vibe Coded Apps

What is SQL injection?

SQL injection is what happens when user input touches database queries without protection. An attacker types malicious SQL into a form field, your code concatenates it into a query, and suddenly they're running whatever commands they want on your database. Entire user tables get dumped in seconds.

Think of your database as a vault and your queries as the combination. SQL injection is when someone tricks you into adding their numbers to the combination. They don't break in. You open the door for them.

According to OWASP Top 10 (2021), injection attacks rank #3 in web application security risks. SQL injection has been in every OWASP Top 10 since the list began in 2003. It's in the CWE Top 25. Two decades later, we're still getting this wrong. AI tools generate vulnerable patterns faster than ever.

How do AI tools cause SQL injection?

Every major AI coding tool generates injectable queries by default. They use template literals because the code looks clean. Clean code that opens a backdoor to your database.

// Cursor, Bolt, Claude Code - all of them generate this
const getUser = async (userId) => {
  const result = await db.query(`
    SELECT * FROM users WHERE id = ${userId}
  `)
  return result.rows[0]
}

Why AI does this: The models are trained on public code, and most public code is insecure. Template literals are everywhere because developers like readable code. AI gives you what it's seen most, not what's safest. It doesn't know the difference.

Cursor, Claude Code, Bolt, v0, GitHub Copilot. Every major tool generates this pattern. Not a bug in any specific tool. Just how AI code generation works. Catching it is on you.

What could happen if I have SQL injection?

All of this has happened. Multiple times. To companies bigger than yours.

• Full database dump: Attacker runs one UNION SELECT and walks away with every user record, every password hash, every piece of payment data stored. Incident responders watch this happen in real-time. It takes minutes.
• Silent data manipulation: Change product prices to $0. Grant themselves admin access. Edit records to cover their tracks. Companies don't notice for weeks. Then customers complain. Revenue looks wrong.
• Authentication bypass: Classic ' OR '1'='1 injection. They log in as admin without knowing any password. Suddenly they have full access to dashboards, user data, everything.
• Total destruction: One DROP TABLE command, entire database gone. Hope there are backups. Hope those backups work.
• Server takeover: Some database configs allow command execution. Attackers go from SQL injection to shell access. Now they own the server, not just the data.

The incident response bill alone costs more than the time it takes to fix your queries now.

How do I detect SQL injection?

In post-breach forensics, this is the first thing investigators check. Search for template literals or string concatenation anywhere near a database query. If you see $${variable} or + variable inside a query, you've found the problem.

// Template literals in queries (DANGEROUS)
db.query(`SELECT * FROM users WHERE id = ${userId}`)

// String concatenation (DANGEROUS)
db.query("SELECT * FROM users WHERE id = " + userId)

// Raw queries with interpolation (DANGEROUS)
prisma.$queryRaw(`SELECT * FROM users WHERE email = '${email}'`)

// Regex to find these patterns:
// \.(query|execute)\s*\(\s*`[^}]*\$\{
// \$queryRaw\s*\(\s*`[^}]*\$\{

How do I fix SQL injection?

The fix is straightforward once you know what to look for: parameterized queries. Every time user input is passed as a parameter instead of concatenated, this entire class of attack gets blocked. Codebases with dozens of injectable queries can be cleaned up in an afternoon. Here's how.

// Template literal - DANGEROUS
const getUser = async (userId) => {
  const result = await db.query(`
    SELECT * FROM users WHERE id = ${userId}
  `)
  return result.rows[0]
}

// An attacker inputs: 1 OR 1=1
// Query becomes: SELECT * FROM users WHERE id = 1 OR 1=1
// Result: Returns ALL users

// Parameterized query - SAFE
const getUser = async (userId) => {
  const result = await db.query(
    'SELECT * FROM users WHERE id = $1',
    [userId]
  )
  return result.rows[0]
}

// An attacker inputs: 1 OR 1=1
// Query becomes: SELECT * FROM users WHERE id = '1 OR 1=1'
// Result: No match found (treated as literal string)

Frequently asked questions

Related content