Loading
Preparing the page
Public context is loading before any interactive tool code.
Preparing the page
Public context is loading before any interactive tool code.
Map declared table columns, filters, sorting and a row limit to reviewable PostgreSQL, MySQL or SQLite SQL without uploading or executing data.
Your checked result will appear here.
Declared table and column names pass a strict identifier gate. Filter values never become SQL text; they occupy ordered placeholders for the application's database driver to bind later.
Restricting the feature set keeps the result inspectable. It generates one-table SELECT statements and never accepts a free-form SQL fragment.
Supply one table and up to 50 column identifiers. Selected, filtered and sorted columns must come from that list.
Select explicit columns or use * alone. Duplicate and unknown selections stop generation.
Comparison and LIKE values become ordered placeholders. Null checks use explicit IS NULL or IS NOT NULL operators without a value.
Every query requires a limit from 1 to 1000. Review the SQL and bind order before execution in a least-privileged environment.
The fixture maps four declared columns to three output fields, two WHERE clauses, one sort and a 50-row limit. The comments show bind order for review; they do not bind or execute the values.
{
"dialect": "postgresql",
"schema": {
"table": "orders",
"columns": ["id", "status", "total_cents", "created_at"]
},
"select": ["id", "status", "total_cents"],
"filters": [
{ "column": "status", "operator": "=", "value": "paid" },
{ "column": "total_cents", "operator": ">=", "value": 1000 }
],
"order_by": [{ "column": "created_at", "direction": "desc" }],
"limit": 50
}-- Parameter 1 ($1) = "paid" -- Parameter 2 ($2) = 1000 SELECT "id", "status", "total_cents" FROM "orders" WHERE "status" = $1 AND "total_cents" >= $2 ORDER BY "created_at" DESC LIMIT 50;
Observed: PostgreSQL · orders · 3 columns · 2 filters · 2 bind values · limit 50
"select":["id; DROP TABLE orders"]The identifier fails before any SQL is emitted; filter values cannot substitute for identifiers.
Identifier quoting and placeholder style vary. The destination driver—not this page—must bind values using its own API and connection rules.
Double-quoted identifiers and positional placeholders such as $1 and $2.
Backtick-quoted identifiers and ordered question-mark placeholders.
Double-quoted identifiers and numbered placeholders such as ?1 and ?2.
All three outputs remain SELECT-only and require an explicit numeric LIMIT.
Safe string construction is only one layer. Access control, types, indexes, row volume and transaction behavior belong to the target system.
Grant only the schemas and columns required for the task; do not rely on the generated verb alone.
A supplied value may be structurally safe but incompatible with the destination column or collation.
Use the database's explain tooling on representative, non-sensitive data before allowing a frequent or high-volume query.
Set driver timeouts, cancellation and result-size controls in addition to the SQL row limit.
The builder prevents values from becoming SQL syntax in this narrow template. It cannot decide who should access a table or whether a query is operationally safe.