Fix SQL Injection Vulnerability in TypeScript

Preventing SQL Injection in TypeScript

SQL injection remains one of the most dangerous web vulnerabilities. It lets attackers execute arbitrary SQL by injecting malicious input through unsanitized user data.

How Injection Happens

When user input is concatenated directly into SQL strings, an attacker can escape the intended query and run their own commands — deleting data, bypassing authentication, or extracting sensitive records.

Vulnerable vs. Safe Code

// VULNERABLE: template literal
await prisma.$queryRawUnsafe(
  `SELECT * FROM users WHERE email = '${email}'`
);

// SAFE: parameterized query
await prisma.$queryRaw`SELECT * FROM users WHERE email = ${email}`;

Defense Checklist

• Always use parameterized queries or prepared statements
• Never concatenate user input into SQL strings
• Use an ORM where possible — they parameterize by default
• Validate and sanitize all user input at the boundary
• Apply least-privilege database permissions to app accounts

Detect Injection Attempts with Bugsly

[Bugsly](https://bugsly.io) flags unusual query patterns and database errors that may indicate injection attempts. Set up alerts for SQL syntax errors from user-facing endpoints to catch attacks before they succeed.

Additional Resources

• Review the official documentation for your framework version
• Search your error tracking tool for similar patterns across your codebase
• Consider adding integration tests that cover this specific scenario
• Document the fix in your team's knowledge base for future reference

Staying proactive about these errors saves debugging time down the road.