SQL Injection Prevention: Prepared Statements vs. Modern ORMs

SQL Injection Prevention: Coding Secure Database Queries

SQL Injection (SQLi) is a classic database vulnerability that occurs when untrusted user inputs are dynamically appended to SQL commands without proper sanitization, allowing attackers to query or delete databases.

---

The Root Cause: Raw String Concatenation

SQLi occurs when code logic combines input values directly:

// VULNERABLE CODE
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
db.execute(query);

If an attacker inputs admin@startup.com' OR '1'='1, the statement compiles to bypass authorization.

---

Clean Mitigations

1. Prepared Statements (Parameterized Queries)

Prepared statements separate SQL commands from data values:

// SECURED CODE
const query = "SELECT * FROM users WHERE email = ?";
db.execute(query, [req.body.email]);

2. Modern ORMs

Libraries like Prisma, Sequelize, or TypeORM parameterize queries automatically. However, avoid raw query methods (e.g. db.queryRaw()) inside ORMs, as they disable parameterized protection.