When code builds a query by gluing strings together, such as adding a search term straight into a SELECT statement, a crafted input can change what the query does. The database cannot tell the developer's SQL from the attacker's.
AI-generated code often does this in raw query helpers, custom search endpoints and admin filters, especially when an ORM feels too restrictive. The result can be leaked tables, bypassed logins or destroyed data. ORMs and the Supabase client are safe when used normally, because they send values separately, but their raw query escape hatches are not.
Always use parameterized queries or prepared statements, so values are passed as parameters and never concatenated. Give the database account your app uses only the permissions it needs, so a mistake cannot drop tables. Validate input types as an extra layer, not as the main defense.
const result = await pool.query(
"select id, name from users where email = $1",
[email]
);