SQL Injection in Cursor-Generated Code: What Gets...

TL;DR Cursor and most AI editors generate SQL queries with user input interpolated directly into template literals This is CWE-89 SQL injection — parameterized queries fix it completely in about ten seconds Automated SAST catches this before it ships; most AI-generated codebases don't run any I've been reviewing codebases built mostly with Cursor and Claude Code for a few months. The SQL injection pattern keeps showing up. Not the obvious string concatenation from old PHP tutorials. The modern v