Does ChatGPT code have SQL injection vulnerabilities?

ChatGPT frequently generates code that is vulnerable to SQL injection, especially when building database query logic. The model often produces string concatenation patterns for SQL queries instead of parameterized queries or prepared statements, which is one of the most dangerous coding practices. This is particularly common when ChatGPT generates code for older frameworks or when the prompt does not explicitly request secure database patterns. Even when using ORMs, ChatGPT may suggest raw query methods that bypass built-in protections. Review database queries with code review or SAST. UNPWNED still checks externally observable configuration, exposure, dependency, and error-disclosure signals. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.