SQL注入防护指南：预处理语句、参数化查询与输入验证最佳实践

sql-injection-prevention by aj-geddes/useful-ai-prompts

171 周安装量

161 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/aj-geddes/useful-ai-prompts --skill sql-injection-prevention

开发数据库安全

🇨🇳中文介绍

SQL 注入防护

概述

使用预处理语句、参数化查询、ORM 最佳实践和输入验证来实现全面的 SQL 注入防护。

使用场景

数据库查询开发
遗留代码安全审查
安全审计修复
API 端点开发
用户输入处理
动态查询生成

快速开始

最小工作示例：

// secure-db.js
const { Pool } = require("pg");

class SecureDatabase {
  constructor() {
    this.pool = new Pool({
      host: process.env.DB_HOST,
      database: process.env.DB_NAME,
      user: process.env.DB_USER,
      password: process.env.DB_PASSWORD,
      max: 20,
      idleTimeoutMillis: 30000,
      connectionTimeoutMillis: 2000,
    });
  }

  /**
   * ✅ SECURE: Parameterized query
   */
  async getUserById(userId) {
    const query = "SELECT * FROM users WHERE id = $1";
    const values = [userId];

    try {
      const result = await this.pool.query(query, values);
// ... (完整实现请参阅参考指南)

参考指南

references/ 目录下的详细实现：

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

指南	内容
Node.js with PostgreSQL	Node.js 与 PostgreSQL
Python with SQLAlchemy ORM	Python 与 SQLAlchemy ORM
Java JDBC with Prepared Statements	Java JDBC 与预处理语句
Input Validation & Sanitization	输入验证与净化

🇺🇸English

SQL Injection Prevention

Overview
When to Use
Quick Start
Reference Guides
Best Practices

Overview

Implement comprehensive SQL injection prevention using prepared statements, parameterized queries, ORM best practices, and input validation.

When to Use

Database query development
Legacy code security review
Security audit remediation
API endpoint development
User input handling
Dynamic query generation

Quick Start

Minimal working example:

// secure-db.js
const { Pool } = require("pg");

class SecureDatabase {
  constructor() {
    this.pool = new Pool({
      host: process.env.DB_HOST,
      database: process.env.DB_NAME,
      user: process.env.DB_USER,
      password: process.env.DB_PASSWORD,
      max: 20,
      idleTimeoutMillis: 30000,
      connectionTimeoutMillis: 2000,
    });
  }

  /**
   * ✅ SECURE: Parameterized query
   */
  async getUserById(userId) {
    const query = "SELECT * FROM users WHERE id = $1";
    const values = [userId];

    try {
      const result = await this.pool.query(query, values);
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Guide	Contents
Node.js with PostgreSQL	Node.js with PostgreSQL
Python with SQLAlchemy ORM	Python with SQLAlchemy ORM
Java JDBC with Prepared Statements	Java JDBC with Prepared Statements
Input Validation & Sanitization	Input Validation & Sanitization

Best Practices

✅ DO

Use prepared statements ALWAYS
Use ORM frameworks properly
Validate all user inputs
Whitelist dynamic values
Use least privilege DB accounts
Enable query logging
Regular security audits
Use parameterized queries

❌ DON'T

Concatenate user input
Trust client-side validation
Use string formatting for queries
Allow dynamic table/column names
Grant excessive DB permissions
Skip input validation

Weekly Installs

120

Repository

aj-geddes/usefu…-prompts

GitHub Stars

121

First Seen

Jan 21, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Installed on

opencode102

gemini-cli101

codex96

claude-code93

cursor90

github-copilot83