Learn SQL and write it with parameters

How to do it

SQL passes the tests as a skill. It has been an ISO standard since 1987, and the latest edition, ISO/IEC 9075:2023, came out in June 2023. In the Stack Overflow Developer Survey 2025, 58.6% of developers used it. SQL is a standard, so the release and licence tests apply to your database instead. Agents write SQL well, and a person who reads it can spot a slow or unsafe query. Always pass values as parameters, as Use parameterised queries says. Read the plan of slow queries, as query plans shows. Choose something else when the data is files or a key-value cache with no queries.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

SQL example

SELECT id, starts_at, seats
FROM bookings
WHERE customer_id = $1 AND starts_at >= $2
ORDER BY starts_at;

JavaScript example

const { rows } = await pool.query(
  'SELECT id, starts_at, seats FROM bookings WHERE customer_id = $1 AND starts_at >= $2 ORDER BY starts_at',
  [customerId, from],
);

Python example

rows = connection.execute(
    "SELECT id, starts_at, seats FROM bookings WHERE customer_id = %s AND starts_at >= %s ORDER BY starts_at",
    (customer_id, from_date),
).fetchall()

How to check

A search of the code finds no query built by joining strings with user input. Every schema change is a SQL migration file in version control, as versioned migrations requires.

Related rules

• Use parameterised queries in Security testing
• Read the query plan in Data
• Change the schema only with migrations in Data