Code fix · 4 checks · max 600 tokens · benched 2026-09-16

Claude Opus 5 vs Claude Sonnet 5 vs Claude Sonnet 4.6 vs Claude Haiku 4.5 on parameterise a sql query in python

Anthropic models side by side on "Parameterise a SQL query in Python": Claude Haiku 4.5 scores 10/10; Claude Haiku 4.5 is the cheapest answer scoring 8+ at $0.37 per 1,000 runs. Outputs, checks, judge reasons, latency and cost.

The prompt every model received

System

You are a senior engineer. Reply with code only unless asked otherwise.

User

This sqlite3 code is vulnerable to SQL injection. Rewrite it to use a parameterised query with sqlite3's ? placeholder. Return the complete corrected function only.

def find_user(cursor, email):
    query = f"SELECT id, name FROM users WHERE email = '{email}'"
    cursor.execute(query)
    return cursor.fetchone()

Rubric for the judge: Uses execute(sql, (email,)) with a ? placeholder, keeps the same columns and return, no string formatting left.

Side by side

Every cell is one OpenRouter call at temperature 0 with the prompt's token cap and reasoning effort "low" where the model supports it. Cost is usage × the catalogue rate in models.json. Quality is one judge call to anthropic/claude-haiku-4.5 against the prompt's rubric, cached per prompt version.

Claude Opus 5

anthropic/claude-opus-5

10/10

Latency: 2.3s
Cost: $0.00235
Per 1,000: $2.35

155 in · 63 out · 17 words · checks 4/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    cursor.execute("SELECT id, name FROM users WHERE email = ?", (email,))
    return cursor.fetchone()
```

Judge: The output correctly uses parameterised query with ? placeholder, passes email as tuple parameter, maintains identical SELECT columns and return statement, eliminates all string formatting, and provides only the corrected function as requested.

Claude Sonnet 5

anthropic/claude-sonnet-5

10/10

Latency: 960ms
Cost: $0.00101
Per 1,000: $1.01

155 in · 70 out · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Judge: The output correctly uses parameterised query with ? placeholder, execute(query, (email,)) syntax, maintains identical SELECT columns and return statement, eliminates all string formatting, and provides only the corrected function as requested.

Claude Sonnet 4.6

anthropic/claude-sonnet-4.6

10/10

Latency: 775ms
Cost: $0.00111
Per 1,000: $1.11

104 in · 53 out · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Claude Haiku 4.5

anthropic/claude-haiku-4.5

10/10

top judge scorecheapest scoring 8+

Latency: 718ms
Cost: $0.00037
Per 1,000: $0.37

103 in · 53 out · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Frequently asked

What does this prompt test?

Code fix: Uses execute(sql, (email,)) with a ? placeholder, keeps the same columns and return, no string formatting left. The deterministic checks are contains, regex, not_contains, not_contains.

Which model should I pick for this task?

If the judge's bar of 8/10 is good enough for you, Claude Haiku 4.5 at $0.37 per 1,000 runs. If you need the top score, Claude Haiku 4.5 at $0.37 per 1,000 runs.

Same prompt, other families

Run it yourself

Re-run this prompt on Anthropic with your own OpenRouter key, or tweak the wording and see what changes.

Side by side

Claude Opus 5

Claude Sonnet 5

Claude Sonnet 4.6

Claude Haiku 4.5

Frequently asked

Same prompt, other families

Stop overpaying for AI tools