SQL Injection

  func getUser(w http.ResponseWriter, r *http.Request) {
      userID := r.URL.Query().Get("id")
-     query := "SELECT * FROM users WHERE id = " + userID
-     rows, err := db.Query(query)
+     rows, err := db.Query("SELECT * FROM users WHERE id = $1", userID)
      // ...
  }
  

- const query = `SELECT * FROM users WHERE id = '${req.params.id}'`;
- await db.query(query);
+ const query = 'SELECT * FROM users WHERE id = $1';
+ await db.query(query, [req.params.id]);
  

- import { PrismaClient } from '@prisma/client';
- const prisma = new PrismaClient();
- 
- app.get('/api/users/search', async (req, res) => {
-   const { name } = req.query;
-   const users = await prisma.$queryRaw`
-     SELECT * FROM "User" WHERE name LIKE '%${name}%'
-   `;
-   res.json(users);
- });
- // Attacker sends: name=' OR 1=1 --
+ import { PrismaClient, Prisma } from '@prisma/client';
+ const prisma = new PrismaClient();
+ 
+ app.get('/api/users/search', async (req, res) => {
+   const { name } = req.query;
+   const users = await prisma.$queryRaw(
+     Prisma.sql`SELECT * FROM "User" WHERE name LIKE ${`%${name}%`}`
+   );
+   res.json(users);
+ });
  

  import { getManager } from 'typeorm';
  
  app.get('/api/users/search', async (req, res) => {
    const { name, role } = req.query;
    const manager = getManager();
    const users = await manager.query(
-     `SELECT * FROM users WHERE name = '${name}' AND role = '${role}'`
-   );
-   res.json(users);
- });
- // Attacker sends: name=' OR '1'='1' --
+     'SELECT * FROM users WHERE name = $1 AND role = $2',
+     [name, role]
+   );
+   res.json(users);
+ });
  

  from flask import request
  import graphene
  
  @app.route('/graphql', methods=['POST'])
  def graphql_endpoint():
-     user_id = request.json.get('id')
-     query = f'{{ user(id: "{user_id}") {{ name email }} }}'
-     result = schema.execute(query)
+     query = request.json.get('query')
+     variables = request.json.get('variables', {})
+     result = schema.execute(query, variables=variables)
      return jsonify(result.data)