6 ms·
SQL Injection in Node.js
- mcv 7y agoI'm not entirely sure what the point of this is. Do we want people to write code that looks unsafe and raises red flags?
- ForbesLindesay 7y agoNo, the point is that people do write code that is unsafe. A cursory glance at recent stack overflow questions tagged with "node.js" and "sql" shows many questions and answers with SQL Injection vulnerabilities. By providing an API that makes it virtually impossible to create an SQL Injection vulnerability, we can allow novices to write code safely. Once you know what the `sql` tag is doing, it's really easy to review the code and be confident it isn't vulnerable.
- mcv 7y agoUntil you accidentally leave out that `sql` tag. Or will that now generate an error?
- spion 7y agoIt will, since the object returned by the tag is not a string.
- ForbesLindesay 7y agoYes, as it says in the article. The tag returns a class that's an instance of SQLQuery. All the @databases clients only accept SQLQuery instances and don't accept strings. This means you get a runtime error if you're using JavaScript, and a type error at build time if you're using TypeScript.