SQL Injection in Node.js

Re:SQL Injection in Node.js by mcv on Monday July 29, 2019 @10:17AM (#20554818)

Until you accidentally leave out that `sql` tag. Or will that now generate an error?

[ Parent | on HN ]

Re:SQL Injection in Node.js by ForbesLindesay on Tuesday July 30, 2019 @01:15PM (#20566903)

Yes, as it says in the article. The tag returns a class that's an instance of SQLQuery. All the @databases clients only accept SQLQuery instances and don't accept strings. This means you get a runtime error if you're using JavaScript, and a type error at build time if you're using TypeScript.

[ Parent | on HN ]

Re:SQL Injection in Node.js by spion on Monday July 29, 2019 @11:42AM (#20555738)

It will, since the object returned by the tag is not a string.

[ Parent | on HN ]