{
  "context": "Tests whether the response identifies the SQL injection vulnerability and provides the correct fix.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Identifies SQL injection",
      "description": "Identifies that string interpolation of req.params.id into the SQL query creates a SQL injection vulnerability",
      "max_score": 20
    },
    {
      "name": "Recommends parameterized queries",
      "description": "Recommends using parameterized/prepared statements (e.g., $1 placeholder or ? with parameter array) as the fix",
      "max_score": 15
    },
    {
      "name": "Shows fixed code",
      "description": "Provides a corrected code example using parameterized queries",
      "max_score": 10
    },
    {
      "name": "Mentions missing error handling",
      "description": "Notes the missing .catch() or try/catch for the database query promise",
      "max_score": 8
    },
    {
      "name": "No incorrect information",
      "description": "Response does not contain factually wrong security advice",
      "max_score": 10
    }
  ]
}