zig-injection is a native Zig SQL injection and XSS detector targeting behavioral compatibility with libinjection 4. It is designed for bounded, allocation-free request inspection and exposes both idiomatic Zig and stable C interfaces.

The project is under active development. Compatibility is measured against a pinned upstream corpus; it is not inferred from API similarity.

• Zig 0.17-dev, resolved through Pantry
• No Git submodules

pantry install
zig build test

Reusable state keeps inspection allocation-free:

const injection = @import("injection");

var state: injection.sqli.State = .{};
const result = injection.sqli.detect("1 UNION SELECT secret", &state);
if (result.is_sqli) {
    // result.reason and result.fingerprintBytes() are valid immediately.
}

Input remains caller-owned. Token offsets refer to byte positions in that input, and fixed-capacity exhaustion is reported through Result.truncated. The API is usable now, but full libinjection 4 compatibility is gated on the pinned differential corpus and the INJECT-04 folding/fingerprint work.

Implementation and compatibility work is tracked by the INJECT roadmap.

For help, discussion about best practices, or any other conversation that would benefit from being searchable:

Discussions on GitHub

For casual chit-chat with others using this package:

Join the zig-utils Discord Server

MIT. Upstream test fixtures retain their original notices and licenses.