Raw Sql Injection Risk (ARCH3055)

Key typescript.orm.raw-sql-injection-risk · Severity critical · Category orm

Building raw/native SQL via string interpolation or concatenation is both an injection vector and a query-plan-cache buster. Always use bound parameters.

Incorrect

const email = req.query.email;
const rows = await dataSource.query(
  `SELECT * FROM users WHERE email = '${email}'`
);

Correct

const email = req.query.email;
const rows = await dataSource.query(
  `SELECT * FROM users WHERE email = $1`,
  [email]
);

Fix

Never embed user input into SQL; use bound (parameterized) query parameters.