Node.js Course
Node.js
/
Intermediate

SQL Injection

Definition

A code injection technique that might destroy your database. It occurs when malicious SQL statements are inserted into entry fields for execution.

Explain Like I'm New

You have a login query: `SELECT * FROM users WHERE email = '` + req.body.email + `'`. A hacker types `' OR '1'='1` into the email field. The final query becomes `SELECT * FROM users WHERE email = '' OR '1'='1'`. Since 1 always equals 1, the database says 'True!' and logs the hacker into the first account in the database (usually the Admin).

Real World Example

The most famous web vulnerability in history. It can be used to bypass logins, steal entire databases, or completely DROP (delete) tables.

Common Use Cases

  • •Securing relational databases (PostgreSQL/MySQL)

Interactive Example

const userInput = "admin@test.com' OR '1'='1";

// --- BAD (VULNERABLE) ---
// String concatenation allows the input to alter the SQL logic.
const badQuery = `SELECT * FROM users WHERE email = '${userInput}'`;
console.log("DANGEROUS QUERY:");
console.log(badQuery);

// --- GOOD (PREPARED STATEMENT) ---
// The SQL logic is locked. The '?' acts as a placeholder.
const goodQuery = `SELECT * FROM users WHERE email = ?`;
const values = [userInput];

// The database engine receives the raw string, but knows it's strictly data, not logic.
// db.execute(goodQuery, values);
console.log("\nSAFE QUERY:");
console.log(goodQuery, "<-- Executed safely with data:", values);

Interview Questions

basic

  • What causes SQL Injection?

intermediate

  • How do you completely prevent SQL Injection?

Flash Cards

Question

What causes it?

Click to reveal answer
Answer

String concatenation. Directly gluing user input strings into database command strings.

Question

How to prevent it?

Click to reveal answer
Answer

Prepared Statements (Parameterized Queries). You send the SQL command and the User Data to the database separately. The database compiles the command first, and treats the user data strictly as a harmless string, making injection impossible. All modern ORMs (Prisma, TypeORM) do this automatically.