How to Ensure Safe SQL Patterns in Cursor Output

1---
2description: Enforce parameterized queries for PostgreSQL
3globs: "*.ts,*.js,*.sql,*.repository.ts,*.service.ts"
4alwaysApply: true
5---
6
7# SQL Parameterization Rules (PostgreSQL)
8- ALWAYS use $1, $2, $3 numbered placeholders in queries
9- NEVER use template literals with ${} in SQL strings
10- NEVER concatenate user input into SQL with + operator
11- NEVER use string interpolation in WHERE, INSERT VALUES, or UPDATE SET
12- For dynamic IN clauses: generate $1, $2, ... $N based on array length
13- For dynamic WHERE: build conditions array and join with AND
14- For LIKE/ILIKE: put wildcards in the parameter value, not the query
15
16## Safe Pattern:
17```typescript
18await db.query('SELECT * FROM users WHERE email = $1 AND active = $2', [email, true]);
19```
20
21## Unsafe Pattern (NEVER):
22```typescript
23await db.query(`SELECT * FROM users WHERE email = '${email}'`);
24```

1interface QueryBuilder {
2  text: string;
3  params: (string | number | boolean | null)[];
4}
5
6export const buildWhereClause = (
7  filters: Record<string, unknown>
8): QueryBuilder => {
9  const conditions: string[] = [];
10  const params: (string | number | boolean | null)[] = [];
11  let paramIndex = 1;
12
13  for (const [key, value] of Object.entries(filters)) {
14    if (value === undefined) continue;
15
16    if (typeof value === 'string' && key.endsWith('Like')) {
17      const column = key.replace('Like', '');
18      conditions.push(`${column} ILIKE $${paramIndex++}`);
19      params.push(`%${value}%`);
20    } else if (Array.isArray(value)) {
21      const placeholders = value.map(() => `$${paramIndex++}`).join(', ');
22      conditions.push(`${key} IN (${placeholders})`);
23      params.push(...value);
24    } else {
25      conditions.push(`${key} = $${paramIndex++}`);
26      params.push(value as string | number | boolean | null);
27    }
28  }
29
30  return {
31    text: conditions.length ? `WHERE ${conditions.join(' AND ')}` : '',
32    params,
33  };
34};

1@sql-params.mdc @src/db/query-builder.ts
2
3Create an OrderRepository with these methods:
41. findAll(filters: OrderFilters) — dynamic WHERE with buildWhereClause
52. findById(id: string) — parameterized $1
63. findByDateRange(start: Date, end: Date) — parameterized BETWEEN
74. create(data: CreateOrderDTO) — parameterized INSERT with RETURNING
85. bulkUpdateStatus(ids: string[], status: string) — parameterized IN clause
9
10All queries MUST use parameterized placeholders.
11Use buildWhereClause for dynamic filtering.
12Never use string interpolation in any SQL.

1@sql-params.mdc @codebase
2
3Search the entire codebase for SQL injection vulnerabilities:
41. Template literals containing SQL keywords with ${} interpolation
52. String concatenation with + near SQL query strings
63. Raw query calls without parameterized placeholders
74. LIKE clauses with interpolated wildcards
85. IN clauses built with string joining
9
10For each vulnerability:
11- Show the file and line number
12- Explain the injection risk
13- Show the parameterized fix

1@sql-params.mdc @src/repositories/order.repository.ts
2
3Generate security tests for OrderRepository that verify SQL injection
4prevention. For each method, test with these injection payloads:
51. "'; DROP TABLE orders; --"
62. "1' OR '1'='1"
73. "1; UPDATE users SET role='admin'"
84. "' UNION SELECT * FROM users --"
9
10Each test should verify:
11- The query executes without error
12- No unintended data is returned or modified
13- The injection payload is treated as a literal string value