Can it distinguish between safe and unsafe ORM usage?

Yes, it identifies when ORM query builders are used safely via parameter binding versus when raw, unescaped strings are passed to methods like whereRaw().

Does this skill support popular PHP frameworks?

Yes, it specifically detects vulnerabilities in Laravel's Eloquent ORM, Doctrine DBAL, and standard PDO implementations.

Does it provide code fixes for the vulnerabilities it finds?

Absolutely. Every detected vulnerability includes a recommended 'Fix' section showing the secure, parameterized version of the code.

How does it handle dynamic table or column names?

It flags dynamic identifiers as critical risks because they cannot be parameterized, and suggests using whitelist-based validation as the secure alternative.

SQL Injection Security Checker

Name: SQL Injection Security Checker
Author: dykyi-roman

bydykyi-roman

•

Seguridad y Pruebas

Detects and mitigates SQL injection vulnerabilities in PHP code through pattern analysis and remediation guidance.

The check-sql-injection skill for Claude Code is a specialized security auditing tool designed specifically for PHP applications. It scans source code for dangerous patterns such as direct string concatenation in queries, insecure variable interpolation, and misused ORM raw methods in frameworks like Doctrine or Laravel's Eloquent. By identifying critical vulnerabilities such as unescaped LIKE clauses and insecure IN statement construction, it provides developers with actionable severity classifications, attack vector analysis, and production-ready secure code alternatives using PDO prepared statements.

Características Principales

01Analyzes dynamic table and column name usage for potential injection points

0245 GitHub stars

03Scans for vulnerable LIKE clauses and improper IN clause parameterization

04Provides standardized security reports with CWE-89 references and fix examples

05Identifies insecure use of raw query methods in Eloquent and Doctrine ORMs

06Detects direct string concatenation and variable interpolation in SQL queries

Casos de Uso

01Validating SQL security during the code review process for new PRs

02Refactoring manual SQL queries to use secure PDO or ORM patterns

03Conducting automated security audits of legacy PHP codebases

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dykyi-roman/awesome-claude-code check-sql-injection

For use in Claude.ai and ChatGPT

Download Skill