# Does Vault engine validate a potential SQL injection attack?

**URL:** <https://discuss.hashicorp.com/t/does-vault-engine-validate-a-potential-sql-injection-attack/46753>\
**Category:** Vault\
**Created:** [November 10, 2022, 4:35pm UTC](https://discuss.hashicorp.com/t/does-vault-engine-validate-a-potential-sql-injection-attack/46753 "2022-11-10T16:35:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dewan-ahmed](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dewan-ahmed/32/11492_2.png) [@dewan-ahmed](https://discuss.hashicorp.com/u/dewan-ahmed)\
**Post date:** [November 10, 2022, 4:35pm UTC](https://discuss.hashicorp.com/t/does-vault-engine-validate-a-potential-sql-injection-attack/46753/1 "2022-11-10T16:35:44Z")

</div>

This is regarding [following SQL creation\_statements](https://developer.hashicorp.com/vault/docs/secrets/databases/postgresql) on Vault:

creation\_statements=“CREATE ROLE "{{name}}" WITH LOGIN PASSWORD ‘{{password}}’ VALID UNTIL ‘{{expiration}}’;   
GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";” \

Does Vault perform some SQL injection checks or the onus is on the engineering team since this configuration is done, presumably by an admin?

---

<div class="post-metadata">

**Author:** ![maxb](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/maxb/32/26655_2.png) [@maxb](https://discuss.hashicorp.com/u/maxb)\
**Post date:** [November 11, 2022, 4:16pm UTC](https://discuss.hashicorp.com/t/does-vault-engine-validate-a-potential-sql-injection-attack/46753/2 "2022-11-11T16:16:23Z")

</div>

The onus is on the person doing the config.