---
author: "Umesh Malik"
canonical: "https://umesh-malik.com/blog/tag/sql-injection"
description: "Explore articles tagged with SQL Injection by Umesh Malik — AI Engineer, LLM & GenAI Developer. Learn SQL Injection best practices, practical tips, and in-depth guides."
title: "Umesh Malik's Blog - SQL Injection Articles | SQL Injection Tutorials"
tokens: 160
generator: "scripts/generate-page-markdown.mjs"
---

[← Back to Blog](https://umesh-malik.com/blog)

# SQL Injection

1 article

 [![Diagram of the Datasette filter injection — a query-string column name flows unquoted into generated SQL and returns rows from a private table](https://umesh-malik.com/blog/datasette-sql-injection-patch-cover.png)

Web Engineering • Aug 7, 2026

### Fix the Datasette SQL Injection: Why execute-sql Won't Save You

The Datasette SQL injection patched in 1.0a38 and 0.65.3 leaks private tables via unescaped filter columns. The check, upgrade, and why execute-sql is no fix.

8 min read

Read more →](https://umesh-malik.com/blog/datasette-sql-injection-patch)