SQL Injection Prevention — Defending Against SQL Injection Attacks

// BAD: String concatenation (vulnerable)
const query = `SELECT * FROM scans WHERE file_name = '${req.query.fileName}'`;

// GOOD: Parameterized queries
const { Pool } = require('pg');
const pool = new Pool();

app.get('/api/scans', async (req, res) => {
  const result = await pool.query(
    'SELECT * FROM scans WHERE file_name = $1 AND user_id = $2',
    [req.query.fileName, req.user.id]
  );
  res.json(result.rows);
});

// ORM protection (TypeORM)
const scan = await dataSource.getRepository(Scan)
  .createQueryBuilder('scan')
  .where('scan.fileName = :fileName', { fileName: req.query.fileName })
  .andWhere('scan.userId = :userId', { userId: req.user.id })
  .getMany();

// Stored procedure with parameterized call
await pool.query('CALL get_user_scans($1, $2)', [req.user.id, req.query.limit]);

// WAF rule for SQL injection
// ModSecurity:
// SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "@detectSQLi" \
//   "id:1000,phase:2,t:none,deny,msg:'SQL Injection detected'"