SQL Query Generation Checklist

Use this before running an AI-generated SQL query against any real database, especially production. - Does the query actually answer the question that was asked, not a plausible-looking but subtly different question (wrong join, wrong aggregation, wrong filter)? - Check the join logic specifically — an unintended cartesian product or a wrong join key silently inflates or duplicates rows without an obvious error. - Are NULLs handled the way you actually need (do they get excluded from a count/filter when they shouldn't be, or vice versa)? - If it's a write query (UPDATE/DELETE), does the WHERE clause actually match only the intended rows — run it as a SELECT first to see exactly what would be affected? - Is there a LIMIT where one matters, and are you certain the query won't return or scan far more rows than expected on real data volume? - Does it use parameterized inputs rather than string-concatenating any value that could come from user input, anywhere this query might get reused? SQL injection risk applies to generated code too. - Does it rely on an index that actually exists, or will it silently full-scan a large table in production? - Have you run it against a copy/staging environment first, if it's anything beyond a trivial read? Never run an AI-generated write query directly against production without first checking, on a read-only version, exactly which rows it would touch.