Keep values separate from SQL syntax
A query often combines fixed instructions with values that come from a form, workflow input, or earlier database result. Build the SQL statement with placeholders and provide the corresponding values in `params`. This avoids treating a value as part of the SQL syntax and reduces errors caused by quoting or escaping user-provided text.
Use the same approach for reads and writes: the SQL Database accepts `{ sql, params }` for reads, while execute operations accept `action: "execute"` with `sql` and `params`. Parameters represent values, not table or column names; identifiers and query structure must be chosen explicitly in the SQL statement.
Check the statement and result
Use the parameter format expected by the connected SQL database and provide values in the same order as the placeholders. Do not assume that a parameter can replace a table name, column name, or SQL keyword. If the query needs a different structure, select that structure deliberately and keep variable data in parameters.
For a read, inspect the returned rows and confirm the filter matched the intended records. For an execute action, review rows, changes, or lastRowId as appropriate. If a write might affect every row, include a deliberate WHERE condition; the tool requires explicit `all: true` for unbounded updates and deletes.