How to Prevent SQL Injection (SQLi)

What is SQL Injection?

SQL Injection (SQLi) is a vulnerability where an attacker injects malicious SQL statements into input fields or parameters, manipulating the query execution database logic. This allows unauthorized access to retrieve, mutate, or destroy system data.

Prevention 1: Prepared Statements (Parametrization)

The primary defense against SQLi is prepared statements. Prepared statements separate the query template from input arguments, forcing the database parser to treat variables as literal values rather than execution code.

// Vulnerable Node.js Node-Postgres Code
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
await db.query(query); // High Risk!

// Secured Code (Parametrized)
const query = 'SELECT * FROM users WHERE email = $1';
await db.query(query, [req.body.email]); // Secure

Prevention 2: Input Sanitation & Escaping

Always validate and sanitize input against strict schemas (e.g. using Zod or Joi). Escape special string qualifiers like single quotes if dynamic formatting is unavoidable.