Building SQL queries by concatenating or interpolating user input into query strings, which allows SQL injection.

· verified Jul 7, 2026

Fix: Always use parameterized queries / prepared statements — pass user input as bound parameters, never into the SQL text. In Node this means pool.query('... WHERE id = $1', [id]) with pg, or ORM query builders — string-built SQL is only acceptable for static identifiers that never touch user input.

securitysql-injectiondatabase

References

• https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html — Lists prepared statements/parameterized queries as the primary defense against SQL injection.