Build a reusable SQL injection detection library with query analysis, parameterization enforcement, and WAF rule generation.
You are a database security specialist. Build an SQL injection prevention library. ## Configuration - **Language**: [LANG e.g. Python / Java / C# / Node.js / Go] - **Database**: [DB e.g. PostgreSQL / MySQL / MSSQL / Oracle] - **ORM**: [ORM e.g. SQLAlchemy / Hibernate / Entity Framework / Prisma / none] - **Integration**: [INTEGRATION e.g. middleware / decorator / static analysis] ## Library Components ### 1. Query Analyzer (`analyzer/`) - Parse SQL queries and identify injection points - Detect string concatenation with user input - Identify non-parameterized dynamic queries - Recognize ORM raw query usage - AST-based analysis for complex query builders - Score injection risk per query: safe/suspicious/dangerous ### 2. Input Sanitizer (`sanitizer/`) - Type-specific validation (integer, UUID, email, date range) - Character whitelist/blacklist by context - SQL keyword detection in user inputs - Unicode normalization to prevent encoding bypasses - Comment syntax detection (-- , /* */, #) - Stacked query detection (semicolons in input) - LIKE clause wildcard escaping ### 3. Query Builder (`builder/`) - Safe parameterized query builder for [DB] - Dynamic WHERE clause construction without string concatenation - Safe ORDER BY with column whitelist - Safe LIMIT/OFFSET with integer validation - IN clause with parameterized arrays - LIKE search with proper escaping - Full-text search helper ### 4. Runtime Protection (`runtime/`) - [INTEGRATION] that intercepts all database queries - Block queries that fail safety analysis - Log suspicious queries with full context (user, IP, session) - Alert on injection attempts - Query allowlist mode for high-security environments - Performance impact: < 1ms per query overhead ### 5. WAF Rule Generation (`waf/`) - Generate ModSecurity/AWS WAF/Cloudflare rules - SQL injection patterns specific to [DB] - Rate limiting rules for suspicious patterns - Geo-blocking integration - Custom rule testing framework ### 6. Testing (`tests/`) - 200+ SQL injection payloads for testing - Bypass technique coverage (encoding, comments, unions, blind) - False positive rate measurement - Performance benchmarks - Integration tests with [ORM] Provide the complete library with installation guide and framework integration examples.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
Install the library for your language and integrate as middleware. Run the analyzer on existing code to find vulnerable queries. Replace with parameterized builder patterns. Deploy WAF rules as defense-in-depth.
Initial release
Sign in and download this prompt to leave a review.