Sql Injection in Express

Express applications should use parameterized queries exclusively for database operations. Here's the secure version of the vulnerable example:

const express = require('express');
const app = express();
app.use(express.json());

const mysql = require('mysql2/promise');
const db = mysql.createPool({...});

app.get('/users/:id', async (req, res) => {
  try {
    const [rows] = await db.execute(
      'SELECT * FROM users WHERE id = ?'
    , [req.params.id]);
    res.json(rows);
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Database error' });
  }

Notice the use of ? placeholders and passing parameters as an array. This prevents any user input from being interpreted as SQL code.

For Sequelize, use the built-in query methods with proper parameterization:

app.post('/search', async (req, res) => {
  try {
    const { name } = req.body;
    const results = await sequelize.query(
      'SELECT * FROM products WHERE name LIKE :name',
      { replacements: { name: `%${name}%` }, type: sequelize.QueryTypes.SELECT }
    );
    res.json(results);
  } catch (err) {
    res.status(500).json({ error: 'Search failed' });
  }

Express middleware can enforce input validation before database queries reach the application logic:

const { body, param } = require('express-validator');

app.post('/users', [
  body('email').isEmail(),
  body('age').isInt({ min: 0, max: 120 }),
  (req, res) => {
    // Validated data is safe to use in queries
  }
]);

For dynamic table access (which should generally be avoided), validate against a whitelist:

const validTables = ['users', 'products', 'orders'];

app.get('/data/:table', (req, res) => {
  const table = req.params.table;
  if (!validTables.includes(table)) {
    return res.status(400).json({ error: 'Invalid table' });
  }
  
  db.query(`SELECT * FROM ${table} LIMIT 10`, (err, results) => {
    res.json(results);
  });

While this example still uses string interpolation for table names, the whitelist validation prevents arbitrary table access. For production, consider using a mapping from safe identifiers to actual table names.