diff --git a/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sql_injection.yaml b/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sql_injection.yaml
new file mode 100644
index 0000000000..253538055c
--- /dev/null
+++ b/litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/policy_templates/sql_injection.yaml
@@ -0,0 +1,85 @@
+# SQL Injection Detection — Keyword-Based Policy Template
+# Uses conditional matching: identifier_words + additional_block_words
+# Same pattern as Prompt Injection template.
+category_name: "sql_injection"
+description: "Detects SQL injection attempts via keyword matching"
+default_action: "BLOCK"
+
+# IDENTIFIER WORDS — SQL keywords that signal a database operation
+identifier_words:
+  - "select"
+  - "drop"
+  - "union"
+  - "delete"
+  - "exec"
+  - "insert"
+  - "truncate"
+  - "grant"
+  - "alter"
+  - "update"
+
+# ADDITIONAL BLOCK WORDS — when combined with identifier words, triggers blocking
+additional_block_words:
+  - "or 1=1"
+  - "drop table"
+  - "union select"
+  - "delete from"
+  - "'; exec"
+  - "into outfile"
+  - "truncate table"
+  - "grant all"
+  - "' or ''='"
+  - "'; shutdown"
+  - "xp_cmdshell"
+  - "sp_addlogin"
+  - "sp_oacreate"
+  - "information_schema"
+  - "load_file"
+  - "waitfor delay"
+  - "benchmark"
+
+# ALWAYS BLOCK — explicit injection phrases (blocked regardless of context)
+always_block_keywords:
+  - keyword: "' or 1=1"
+    severity: "high"
+  - keyword: "'; drop table"
+    severity: "high"
+  - keyword: "union select null"
+    severity: "high"
+  - keyword: "' or ''='"
+    severity: "high"
+  - keyword: "'; shutdown"
+    severity: "high"
+  - keyword: "'; exec xp_cmdshell"
+    severity: "high"
+  - keyword: "information_schema.tables"
+    severity: "high"
+  - keyword: "information_schema.columns"
+    severity: "high"
+  - keyword: "into outfile"
+    severity: "high"
+  - keyword: "load_file"
+    severity: "high"
+  - keyword: "' union select"
+    severity: "high"
+  - keyword: "waitfor delay"
+    severity: "high"
+  - keyword: "benchmark"
+    severity: "medium"
+
+# EXCEPTIONS — legitimate use cases
+exceptions:
+  - "what is"
+  - "explain"
+  - "how to prevent"
+  - "how to protect"
+  - "how do companies defend"
+  - "how to sanitize"
+  - "research on"
+  - "study on"
+  - "academic"
+  - "security class"
+  - "best practices"
+  - "security research"
+  - "penetration testing"
+  - "security audit"