Parameterize Database Queries with AI Prompts

Convert these Node.js database queries to use parameterization.

Database library: pg/mysql2/better-sqlite3

Find all queries using string concatenation or template literals:

• `SELECT * FROM users WHERE id = ${id}`
• "SELECT * FROM posts WHERE title = '" + title + "'"
• query("DELETE FROM items WHERE id = " + req.params.id)

Convert each to:

1. Parameterized syntax for my specific library
2. Show the values array passed separately
3. Keep the same query logic, just make it safe

Library-specific examples needed:

• pg: $1, $2 placeholders with values array
• mysql2: ? placeholders
• better-sqlite3: ? or named

Convert Python database queries to parameterized statements.

Library: psycopg2/mysql-connector/sqlite3/SQLAlchemy

Find unsafe patterns:

• f"SELECT * FROM users WHERE email = '{email}'"
• "SELECT * FROM posts WHERE id = %s" % post_id
• cursor.execute("DELETE FROM items WHERE id = " + str(item_id))

Convert to proper parameterization:

• psycopg2: %s placeholders with tuple
• sqlite3: ? placeholders with tuple
• SQLAlchemy: Use text() with params or ORM methods

For each conversion, show:

1. The unsafe original
2. The safe parameterized version
3. Why the original was vulnerable

Find and fix unsafe raw queries within my ORM code.

ORM: Prisma/Sequelize/TypeORM/Django ORM/SQLAlchemy

Even with an ORM, I might have unsafe patterns:

• Raw query methods with string interpolation
• Bypassing the ORM for complex queries
• Using .extra() or raw() incorrectly

For each issue found:

1. Convert to use ORM's safe raw query syntax
2. Or rewrite using the ORM's query builder
3. Show both options when possible

Examples to check:

• Prisma: $queryRaw with template strings (safe) vs concatenation (unsafe)
• Sequelize: sequelize.query() with replacements
• TypeORM: Raw() with parameters
• Django: .raw() and .extra() usage

Help me parameterize bulk database operations safely.

Scenarios:

1. INSERT multiple rows at once
2. UPDATE with dynamic WHERE IN clause
3. DELETE multiple items by ID list

Current unsafe approach:

• Building VALUES string: "('" + values.join("'),('") + "')"
• Building IN clause: "WHERE id IN (" + ids.join(",") + ")"

Convert to safe versions:

1. Use proper multi-row INSERT syntax with parameters
2. Use array parameters for IN clauses where supported
3. Generate correct number of placeholders dynamically

Show solutions for:

• PostgreSQL (ANY($1) syntax)
• MySQL (multiple ? placeholders)
• Generic approach for any database