SQL Injection via Unsanitized Input
What Is This Vulnerability?
SQL injection occurs when user-supplied data is concatenated directly into SQL queries without proper sanitization or parameterization. An attacker can manipulate the query logic to read, modify, or delete data they should not have access to, and in some cases execute administrative operations on the database.
Why It Happens
Developers often build SQL queries using string concatenation or template literals with raw user input. This happens when ORMs are bypassed for performance, when legacy code predates parameterized query support, or when input validation is mistakenly treated as a substitute for parameterized queries.
Example Code
app.get("/users", async (req, res) => {
const { username } = req.query;
const result = await db.query(
`SELECT * FROM users WHERE username = '${username}'`
);
res.json(result.rows);
});app.get("/users", async (req, res) => {
const { username } = req.query;
const result = await db.query(
"SELECT * FROM users WHERE username = $1",
[username]
);
res.json(result.rows);
});How Hackers Exploit It
Attackers submit crafted payloads like ' OR '1'='1 in form fields, query parameters, or HTTP headers. Automated tools such as sqlmap can enumerate databases, dump tables, and extract credentials within minutes. In severe cases, attackers use stacked queries to drop tables or execute system commands via xp_cmdshell.
How to Fix It
Always use parameterized queries or prepared statements. If you use an ORM like Prisma or Drizzle, stick to its query builder instead of raw SQL. Apply the principle of least privilege to database accounts so the application user cannot drop tables or access system procedures. Add a web application firewall as an additional layer of defense.