Code fix · 4 checks · max 600 tokens · benched 2026-09-16

Mistral Large 3 2512 vs Mistral Medium 3.5 vs Mistral Small 4 vs Ministral 3 8B 2512 on parameterise a sql query in python

Mistral AI models side by side on "Parameterise a SQL query in Python": Ministral 3 8B 2512 scores 10/10; Ministral 3 8B 2512 is the cheapest answer scoring 8+ at $0.02 per 1,000 runs. Outputs, checks, judge reasons, latency and cost.

The prompt every model received

System

You are a senior engineer. Reply with code only unless asked otherwise.

User

This sqlite3 code is vulnerable to SQL injection. Rewrite it to use a parameterised query with sqlite3's ? placeholder. Return the complete corrected function only.

def find_user(cursor, email):
    query = f"SELECT id, name FROM users WHERE email = '{email}'"
    cursor.execute(query)
    return cursor.fetchone()

Rubric for the judge: Uses execute(sql, (email,)) with a ? placeholder, keeps the same columns and return, no string formatting left.

Side by side

Every cell is one OpenRouter call at temperature 0 with the prompt's token cap and reasoning effort "low" where the model supports it. Cost is usage × the catalogue rate in models.json. Quality is one judge call to anthropic/claude-haiku-4.5 against the prompt's rubric, cached per prompt version.

Mistral Large 3 2512

mistralai/mistral-large-2512

10/10

Latency: 527ms
Cost: $0.00011
Per 1,000: $0.11

87 in · 42 out · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Judge: The output correctly uses parameterised query with ? placeholder, execute(query, (email,)) syntax, maintains identical SELECT columns and return statement, eliminates all string formatting, and provides only the corrected function as requested.

Mistral Medium 3.5

mistralai/mistral-medium-3-5

10/10

Latency: 450ms
Cost: $0.00286
Per 1,000: $2.86

99 in · 361 out (378 reasoning) · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Mistral Small 4

mistralai/mistral-small-2603

10/10

Latency: 10.4s
Cost: $0.00015
Per 1,000: $0.15

99 in · 223 out (208 reasoning) · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Ministral 3 8B 2512

mistralai/ministral-8b-2512

10/10

top judge scorecheapest scoring 8+

Latency: 884ms
Cost: $1.9e-5
Per 1,000: $0.02

87 in · 42 out · 20 words · checks 3/4

contains
regex
not_contains
not_contains

```python
def find_user(cursor, email):
    query = "SELECT id, name FROM users WHERE email = ?"
    cursor.execute(query, (email,))
    return cursor.fetchone()
```

Frequently asked

What does this prompt test?

Code fix: Uses execute(sql, (email,)) with a ? placeholder, keeps the same columns and return, no string formatting left. The deterministic checks are contains, regex, not_contains, not_contains.

Which model should I pick for this task?

If the judge's bar of 8/10 is good enough for you, Ministral 3 8B 2512 at $0.02 per 1,000 runs. If you need the top score, Ministral 3 8B 2512 at $0.02 per 1,000 runs.

Same prompt, other families

Run it yourself

Re-run this prompt on Mistral AI with your own OpenRouter key, or tweak the wording and see what changes.

Side by side

Mistral Large 3 2512

Mistral Medium 3.5

Mistral Small 4

Ministral 3 8B 2512

Frequently asked

Same prompt, other families

Stop overpaying for AI tools