SQL Safety Checker

Scan SQL for destructive statements such as DROP, TRUNCATE, DELETE or UPDATE without a WHERE clause, ALTER ... DROP and privilege changes, and see each one explained, without ever running it.

  • Runs locally in your browser
  • No upload required

Try it

Processed entirely in your browser; never uploaded.

Each dialect has its own comment, string and identifier rules.

Statements
2
Destructive statements
2
Highest severity
high
high drop
DROP removes a table object and its data permanently.
high delete-without-where
DELETE has no WHERE clause, so it removes every row in the table.
high: drop: DROP removes a table object and its data permanently.
high: delete-without-where: DELETE has no WHERE clause, so it removes every row in the table.

Supported formats

Input
text/plain
Output
text

Privacy

Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.

Processing
In your browser
Privacy level
Browser only

1 destructive or high-risk statement(s) found (highest: high).

How it works

  • Split the script into top-level statements.
  • Classified each statement and checked for a WHERE guard where one is required.
  • Reported every destructive shape with a severity and a basis.
  • Severities are high for DROP/TRUNCATE/DELETE-without-WHERE and medium for UPDATE-without-WHERE/ALTER ... DROP/privilege changes.

Methodology

  1. Split the script into top-level statements, respecting strings, identifiers and comments.
  2. Classify each statement's leading command and whether it carries a WHERE clause.
  3. Assign a severity and a plain-language basis to every destructive or high-risk shape found.

Usage

  1. Paste a SQL statement or a migration script.
  2. Choose the dialect.
  3. Run the checker and review each flagged statement and its basis before acting.

Examples

These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.

A destructive migration

jsonSelect to copy
{
  "text": "DROP TABLE users;",
  "dialect": "postgresql"
}

Delete without a WHERE clause

jsonSelect to copy
{
  "text": "DELETE FROM audit_log;",
  "dialect": "mysql"
}

A guarded delete is safe

jsonSelect to copy
{
  "text": "DELETE FROM sessions WHERE expires_at < now();",
  "dialect": "postgresql"
}

Limitations

Review before you run

A migration that drops a column or truncates a table cannot be undone by a transaction in every engine. Reading the flagged statements first is the cheapest possible safeguard.

Nothing is executed

The checker is a reader: it tokenises the text in your browser and reports what it sees. It opens no connection and runs no statement.

Frequently asked questions

Will this run my SQL to detect the risk?
No. It only reads the text; no database connection is opened and nothing is executed.
Is every DROP flagged?
Yes. DROP of any object type is high severity because it removes the object and its data permanently.
Why is UPDATE without WHERE only medium?
It can rewrite every row, which is destructive, but it does not delete the table structure; the severity reflects that difference.

Sources

  1. ISO/IEC 9075-1:2023: Information technology, Database languages SQL — ISO/IEC
  2. PostgreSQL Documentation: SQL Syntax, Lexical Structure — PostgreSQL Global Development Group
  3. MySQL 8.0 Reference Manual: String Literals — Oracle
  4. SQLite Documentation: SQL Syntax — SQLite Consortium
  5. Microsoft Learn: Transact-SQL Syntax Conventions — Microsoft