Preventing SQL Injection: Never Trust User Input

Why it exists

SQL Injection exists because developers sometimes mix data with code. If user input (data) is concatenated directly into a SQL query string (code), an attacker can provide malicious input that changes the query's logic, allowing them to bypass authentication, steal data, or even destroy the database.

The mental model

Think of your SQL query as a form letter with blank spaces, like "Dear __, you have won __ dollars!". User input is the data used to fill in those blanks. Parameterized queries ensure that the input ('John Smith', '100') can only be treated as data for the blanks, never as part of the letter's structure itself.

How it works

The correct defense is to use parameterized queries, also known as prepared statements. Your application sends the SQL command to the database server with placeholders (like ? or $1) instead of the actual user data. In a separate step, it sends the user's data. The database engine first parses and compiles the query's structure, then safely inserts the data into the placeholders. Because the query's logic is already locked in, the data cannot be executed as a command.

When to use it

Always. Every time your Node.js application constructs a SQL query that includes variable data, especially data originating from an external source like a user's browser, an API call, or a file. There is no performance penalty significant enough to justify avoiding them.

When not to use it

There is no valid reason to avoid parameterized queries when dealing with external data. Manually building queries via string concatenation is an anti-pattern. Even for dynamic queries where column or table names must change, those names should come from a hardcoded allow-list, not directly from user input.

One canonical example

Imagine a user login in an Express app. The VULNERABLE way uses string concatenation: const query = "SELECT FROM users WHERE username = '" + req.body.username + "'";. An attacker could enter ' OR '1'='1 as the username, making the query ...WHERE username = '' OR '1'='1', which is always true, bypassing the login. The SECURE way uses parameterization (e.g., with the mysql2 library): const sql = "SELECT FROM users WHERE username = ?"; db.query(sql, [req.body.username]);. Here, the malicious input is treated as a literal string, and the database correctly finds no user with that name.