Analyze database queries with houtini-lm

Quick Start

Jump straight in with these copy-paste prompts. You'll be amazed at what database security issues this can catch:

Please analyze this PHP file for database security issues: C:/api/UserService.php

Check this WordPress plugin file for slow database queries: C:/wp-plugin/includes/DataHandler.php

Analyze all database queries in this Laravel controller: C:/app/Http/Controllers/ReportController.php

What It Does

Think of this as having a database security expert review every query in your code. analyze_database_queries extracts database interactions from PHP, JavaScript, TypeScript, and Python files, then performs comprehensive security and performance analysis.

It's like having a specialist who knows exactly what to look for:

• SQL Injection Detection - Spots vulnerable query construction patterns
• Performance Analysis - Identifies N+1 queries, missing indexes, inefficient patterns
• Security Best Practices - Prepared statements, input sanitisation, privilege checks
• Framework Patterns - Laravel Eloquent, WordPress $wpdb, Node.js ORM analysis
• Data Exposure Risks - Overprivileged queries, sensitive data handling

The analysis understands context - it knows the difference between a dynamic search query (which needs careful handling) and a static configuration query (which is usually safe).

Parameters

Here's what you can customise to get exactly the database analysis you need:

*One of filePath, code, or projectPath is required

Real-World Examples

Here's how to use it for different database security scenarios:

Laravel Application Security Review

houtini-lm:analyze_database_queries with:
- filePath: "C:/laravel-app/app/Http/Controllers/UserController.php"
- language: "php"
- analysisType: "security"
- context: {"framework": "Laravel", "database": "MySQL", "version": "10"}

WordPress Plugin Database Audit

houtini-lm:analyze_database_queries with:
- projectPath: "C:/wp-plugin"
- language: "php"
- analysisType: "comprehensive"
- context: {"framework": "WordPress", "wpdb": true, "custom_tables": true}

Node.js API Performance Review

houtini-lm:analyze_database_queries with:
- filePath: "C:/api/src/services/ReportService.ts"
- language: "typescript"
- analysisType: "performance"
- context: {"orm": "Prisma", "database": "PostgreSQL"}

Direct SQL Code Review

houtini-lm:analyze_database_queries with:
- code: "$query = \"SELECT * FROM users WHERE id = \" . $_GET['id'];"
- language: "php"
- analysisType: "security"

What You Get Back

The analysis delivers actionable insights that help you secure and optimize your database interactions:

🔒 Security Vulnerability Detection

• SQL Injection Risks - Specific vulnerable queries with exploit examples
• Input Validation Issues - Missing sanitization, type checking problems
• Authentication Bypasses - Queries that might bypass security checks
• Data Exposure Risks - Overprivileged queries returning sensitive data
• Injection Vectors - User input paths that reach database queries

⚡ Performance Optimization

• N+1 Query Detection - Loops that cause database hammering
• Missing Index Identification - Queries that would benefit from indexes
• Inefficient Patterns - SELECT *, unnecessary JOINs, subquery issues
• Query Complexity Analysis - Overly complex queries with simplification suggestions
• Connection Management - Connection pooling and resource usage patterns

📋 Framework-Specific Best Practices

• Laravel Eloquent - Relationship usage, query scopes, mass assignment
• WordPress $wpdb - Prepared statements, nonces, capability checks
• Node.js ORMs - Sequelize, Prisma, TypeORM patterns and optimization
• Raw SQL - Prepared statement usage, parameterization, escaping

🛠️ Specific Fixes and Improvements

• Before/after code examples showing exactly how to fix issues
• Prepared statement conversions with proper parameterization
• Query optimization suggestions with performance impact estimates
• Security implementation patterns using framework best practices
• Testing recommendations to verify fixes work correctly

Perfect Use Cases

Here's when this function becomes your database security guardian:

🛡️ Pre-Deployment Security Review

Before pushing authentication, user management, or payment handling code, run it through database security analysis. Catch SQL injection vulnerabilities before they become headlines.

🔍 Legacy Code Assessment

Inherited an application with questionable database practices? Get a comprehensive security and performance assessment of all database interactions to prioritise your fixes.

⚡ Performance Investigation

When your application is slow and you suspect the database, paste the suspect code and get specific recommendations about query optimization and bottleneck elimination.

📚 Code Review Enhancement

Before peer reviews, run your database code through analysis to catch issues early. Makes you look thorough and security-conscious to your team.

🎓 Security Learning

Understanding what makes database code secure vs vulnerable. Learn to recognize dangerous patterns and understand why certain approaches are problematic.

✅ Compliance Preparation

When preparing for security audits (PCI DSS, SOC 2, etc.), use this to identify and document database security measures and potential compliance issues.

Security Focus Areas

Understanding what this analysis prioritises helps you write more secure database code:

🎯 Critical Security Patterns

📈 Performance Anti-Patterns

🏗️ Framework-Specific Security

Different frameworks have different security patterns that this analysis understands:

• Laravel - Mass assignment protection, query scopes, Eloquent relationships
• WordPress - Nonce verification, capability checks, $wpdb prepared statements
• Node.js - ORM parameterization, connection pooling, async security patterns
• Raw SQL - Prepared statements, stored procedures, privilege minimization

Best Practices

Get the most valuable insights from your database query analysis:

🎯 Focus Your Analysis

• "security" - Before production deployment, especially for authentication/payment code
• "performance" - When investigating slow operations or high database load
• "comprehensive" - For complete code reviews or security audits

📋 Provide Framework Context

Better context means more accurate analysis:

• Specify your framework and version: {"framework": "Laravel", "version": "10"}
• Include database type: {"database": "MySQL", "version": "8.0"}
• Mention ORM details: {"orm": "Eloquent", "relationships": true}
• Note custom patterns: {"custom_tables": true, "stored_procedures": true}

🔍 Start with High-Risk Code

Prioritise analyzing code that handles:

• User authentication and authorization
• Payment and financial transactions
• Personal or sensitive data
• Admin or privileged operations
• Public-facing search and filtering

⚡ Multi-File vs Single-File

• Single file analysis - Quick security checks, focused performance review
• Project-wide analysis - Comprehensive security audit, architectural review
• Code snippet analysis - Quick validation of suspicious query patterns

Troubleshooting

Hit a snag with database query analysis? Here are solutions to common issues: