Sql Injection Union in Adonisjs

Fixing UNION-based SQL injection in Adonisjs requires replacing raw string interpolation with parameterized queries or the Lucid ORM's safe query builder. For raw queries, use parameter binding:

// Fixed: Using parameterized raw query
async search({ request, response }) {
  const term = request.input('q')
  const results = await Database.raw(
    `SELECT * FROM posts WHERE title LIKE ? OR content LIKE ?`,
    [`%${term}%`, `%${term}%`]
  )
  return response.json(results.rows)
}

The ? placeholders ensure Adonisjs's underlying Knex.js driver treats inputs as data, not executable SQL. For Lucid models, avoid raw queries entirely:

// Fixed: Using Lucid query builder
async search({ request, response }) {
  const term = request.input('q')
  const results = await Post.query()
    .where('title', 'LIKE', `%${term}%`)
    .orWhere('content', 'LIKE', `%${term}%`)
  return response.json(results)
}

In hooks or validators, use Lucid's existence checks:

// Fixed: Using Lucet for uniqueness
static boot() {
  super.boot()
  this.addHook('beforeSave', async (user) => {
    if (user.$dirty.includes('email')) {
      const exists = await Post.query().where('email', user.email).first()
      if (exists) throw new Error('Email exists')
    }
  })
}

Additionally, enable Adonisjs's built-in validation and sanitization:

// Start/controller method with validation
async search({ request, response }) {
  const { q } = request.validate({
    schema: schema.create({
      q: schema.string.trim(),
    })
  })
  // ... safe query using q
}

These approaches prevent UNION injection by ensuring user input never alters query structure. middleBrick's remediation guidance will specify these exact patterns when it detects unsafe raw query usage in scanned endpoints.