Does Cursor add SQL injection protection?

Cursor does not consistently generate SQL-injection-safe code. Depending on the context and prompt, it may produce queries using string concatenation or template literals instead of parameterized queries or prepared statements. When using ORMs like Prisma or Drizzle, the risk is lower since these tools parameterize by default, but raw SQL snippets generated by Cursor should always be reviewed. SQL injection remains one of the OWASP Top 10 vulnerabilities and can lead to complete database compromise. UNPWNED checks your application for SQL injection vulnerabilities and other injection attack vectors.