diff --git a/cli/templates/integrations/neon/files/lib/neon-client.ts b/cli/templates/integrations/neon/files/lib/neon-client.ts
index 6be858b7d6..70c044a38c 100644
--- a/cli/templates/integrations/neon/files/lib/neon-client.ts
+++ b/cli/templates/integrations/neon/files/lib/neon-client.ts
@@ -251,6 +251,12 @@ export async function getTableRowCount(
   tableName: string,
   schema: string = "public",
 ): Promise<number> {
+  if (!/^[a-zA-Z0-9_]+$/.test(schema)) {
+    throw new Error('Invalid schema name: must contain only letters, numbers, and underscores');
+  }
+  if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {
+    throw new Error('Invalid table name: must contain only letters, numbers, and underscores');
+  }
   const result = await query<{ count: string }>(
     `SELECT COUNT(*) as count FROM "${schema}"."${tableName}"`,
   );