// SECURITY
What is SQL injection, and can it happen to an AI-built app?
Updated 2026-08-11 · 5 min read
SQL injection is when user input is pasted straight into a database query, letting an attacker rewrite that query, to dump, change, or delete data, just by typing the right thing into a form or URL. It is prevented by using parameterized queries so input is always treated as data, never as commands.
What it is
Think of a query as a sentence the database obeys. If your app builds that sentence by gluing in whatever the user typed, a clever user can add their own clauses, and the database will obey those too.
Why it matters to you
A single crafted request can dump your entire database, or wipe it. It is one of the oldest and most damaging web vulnerabilities.
How it happens in AI-built apps
If you use Supabase or Firebase client libraries as intended, you are mostly protected, they parameterize for you. The risk shows up when AI writes custom SQL, database functions, or a raw query that concatenates user input as a string.
The fix
- Always use parameterized queries / prepared statements, never string-concatenate user input into SQL.
- Use your ORM or the Supabase/Firebase client query builders rather than hand-built SQL strings.
- Validate and constrain inputs (type, length, allowed values) as an extra layer.
// unsafe: `select * from users where email = '${email}'`
// safe (parameterized):
select * from users where email = $1; -- pass `email` as a bound parameterKey takeaways
- SQL injection = user input treated as commands instead of data.
- Client libraries (Supabase/Firebase) parameterize for you; raw SQL from AI is the risk.
- Always parameterize; never glue user input into a query string.
Sources
Frequently asked
Am I safe because I use Supabase?
Mostly, as long as you use the query builder. If your app or a database function runs raw SQL built from user input, injection is still possible.