Does Cursor add SQL injection protection?

Cursor does not consistently generate SQL-injection-safe code. Depending on the context and prompt, it may produce queries using string concatenation or template literals instead of parameterized queries or prepared statements. When using ORMs like Prisma or Drizzle, the risk is lower since these tools parameterize by default, but raw SQL snippets generated by Cursor should always be reviewed. SQL injection remains one of the OWASP Top 10 vulnerabilities and can lead to complete database compromise. Review database queries with code review or SAST. UNPWNED still checks externally observable configuration, exposure, dependency, and error-disclosure signals. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.