One search returned every customer
In this controlled demo, a search box meant to find one name returns every customer, because the search text becomes part of the database query itself.
Demo built and tested 20 Sept 2026 · Published 23 Sept 2026 · Last reviewed 23 Sept 2026 · By Ctrl+Z Therapy (how we test)
Can a search box leak my whole database?
Yes, if the search text is pasted into the database query. That is called SQL injection: specially crafted input changes what the query does, for example returning every row instead of one name. The fix is a parameterized query, which keeps the user's text as a value and never as part of the query.
How to tell if your app has this
No code needed.
- Ask your AI tool: "Show every database query that uses text from the user. Is any of it built by joining strings?"
- On your own app, search for ' OR 1=1 -- in a search or filter box. If you get more results than a normal search, the query is injectable.
- Look for query text built with + or template strings around user input.
Before and after
A strange search, and every customer came back.
Same input, treated as a name: 0 results.
Why AI-built apps end up with this
Building a query by joining the search text into a string is short and works in every normal test. Most modern tools and ORMs parameterize by default, so this usually appears in hand-written or raw SQL that was generated for a quick feature.
How do I fix it? Paste this into your AI tool
My search builds the SQL query by pasting the user's text into the query string. Rewrite every database query that uses user input to use parameterized queries (placeholders) instead of string concatenation, and don't rely on stripping special characters. Then check that searching for ' OR 1=1 -- returns no results and a normal name still works.Works with Lovable, Bolt, Cursor, Replit and similar tools. Then run the check-up below on your own app.
How we checked the fix
| Same request | Before | After |
|---|---|---|
| Search: ' OR 1=1 -- | Every row (2) | 0 rows |
| Search: Alice | Not tested | 1 row |
Results from our demo test, run against the same demo before and after the fix.
Common mistakes when fixing this
- Filtering suspicious characters is not a reliable fix. There is always another trick.
Questions people ask
Can't I just remove quotes and special characters?
Not reliably. There are many ways around character filters. Parameterized queries solve the problem at the root because the input is never treated as SQL.
I use Supabase or an ORM. Am I safe?
Their normal query builders are parameterized. The risk returns when raw SQL strings or database functions are built with user input.
Is it only search boxes?
No. Any input that reaches a query can do this: filters, sort options, IDs in URLs and form fields.
For developers: the cause and the fix in code
− sql = "... name = '" + q + "'" + execute("... name = ?", (q,))
Simplified. Your stack will look different; the principle is the same.