How do I protect my website from SQL injection?
Use parameterized queries everywhere user input reaches SQL, and never build a query by joining strings. The database then treats the input as data, not as part of the command.
The fix
db.query("SELECT * FROM users WHERE id = " + id);db.query("SELECT * FROM users WHERE id = $1", [id]);Find and fix every one
- Search your code for queries built with
+, template strings or string formatting. - Check raw queries inside your ORM too. An ORM only helps when you use its parameters.
- Allow-list anything that can't be a parameter, such as a column name in
ORDER BY. - Give the app's database user only the permissions it needs.
- Add a test that sends a value containing a quote and confirms the query still treats it as plain data.
Is input validation enough?
No. Validation helps, and it catches many mistakes, but parameters are the fix. Escaping by hand is easy to get wrong.
Check your whole codebase
Cyber mode reads your code, finds the holes and tells you what to fix first. You approve every fix. Use it only on code you own or may test, and review each change, because AI can miss issues.