SQL injection (ARCH3100)

Key typescript.security.sql-injection · Severity error · Category security · CWE CWE-89

Building a SQL query by concatenating or interpolating user input lets attackers alter the query structure to read or modify data.

Incorrect

app.get("/users", async (req, res) => {
  // email="' OR '1'='1"
  const rows = await db.query(
    `SELECT * FROM users WHERE email = '${req.query.email}'`
  );
  res.json(rows);
});

Correct

app.get("/users", async (req, res) => {
  const rows = await db.query(
    "SELECT * FROM users WHERE email = $1",
    [req.query.email]
  );
  res.json(rows);
});

Fix

Always use parameterized queries or prepared statements; never concatenate input into the query string.