SQL Safety Checker
Scan SQL for destructive statements such as DROP, TRUNCATE, DELETE or UPDATE without a WHERE clause, ALTER ... DROP and privilege changes, and see each one explained, without ever running it.
- Runs locally in your browser
- No upload required
Try it
Supported formats
Privacy
Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.
1 destructive or high-risk statement(s) found (highest: high).
How it works
- Split the script into top-level statements.
- Classified each statement and checked for a WHERE guard where one is required.
- Reported every destructive shape with a severity and a basis.
- Severities are high for DROP/TRUNCATE/DELETE-without-WHERE and medium for UPDATE-without-WHERE/ALTER ... DROP/privilege changes.
Methodology
- Split the script into top-level statements, respecting strings, identifiers and comments.
- Classify each statement's leading command and whether it carries a WHERE clause.
- Assign a severity and a plain-language basis to every destructive or high-risk shape found.
Usage
- Paste a SQL statement or a migration script.
- Choose the dialect.
- Run the checker and review each flagged statement and its basis before acting.
Examples
These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.
A destructive migration
{
"text": "DROP TABLE users;",
"dialect": "postgresql"
}Delete without a WHERE clause
{
"text": "DELETE FROM audit_log;",
"dialect": "mysql"
}A guarded delete is safe
{
"text": "DELETE FROM sessions WHERE expires_at < now();",
"dialect": "postgresql"
}Limitations
Review before you run
A migration that drops a column or truncates a table cannot be undone by a transaction in every engine. Reading the flagged statements first is the cheapest possible safeguard.
Nothing is executed
The checker is a reader: it tokenises the text in your browser and reports what it sees. It opens no connection and runs no statement.
Frequently asked questions
- Will this run my SQL to detect the risk?
- No. It only reads the text; no database connection is opened and nothing is executed.
- Is every DROP flagged?
- Yes. DROP of any object type is high severity because it removes the object and its data permanently.
- Why is UPDATE without WHERE only medium?
- It can rewrite every row, which is destructive, but it does not delete the table structure; the severity reflects that difference.
Sources
- ISO/IEC 9075-1:2023: Information technology, Database languages SQL — ISO/IEC
- PostgreSQL Documentation: SQL Syntax, Lexical Structure — PostgreSQL Global Development Group
- MySQL 8.0 Reference Manual: String Literals — Oracle
- SQLite Documentation: SQL Syntax — SQLite Consortium
- Microsoft Learn: Transact-SQL Syntax Conventions — Microsoft
Send feedback
Tell us if this tool helped, report a problem, or suggest a tool. Only the message you type is sent — never the input you used in the tool.
Was this tool useful?
Prefer to write to us directly? See the contact page.