diff --git a/src/service/alerts/alert.rs b/src/service/alerts/alert.rs
index e1a6152d95..713e2720d0 100644
--- a/src/service/alerts/alert.rs
+++ b/src/service/alerts/alert.rs
@@ -48,6 +48,7 @@ use crate::{
     service::{
         alerts::{build_sql, destinations},
         db,
+        search::sql::RE_ONLY_SELECT,
     },
 };
 
@@ -187,6 +188,13 @@ pub async fn save(
             {
                 return Err(anyhow::anyhow!("Alert with SQL mode should have a query"));
             }
+            if alert.query_condition.sql.is_some()
+                && RE_ONLY_SELECT.is_match(alert.query_condition.sql.as_ref().unwrap())
+            {
+                return Err(anyhow::anyhow!(
+                    "Alert with SQL can not contain SELECT * in the SQL query"
+                ));
+            }
         }
         QueryType::PromQL => {
             if alert.query_condition.promql.is_none()