ForbesLindesay
Designing a Notifications Service with SQS and SNS
Is-Promise Post Mortem
Using SQLite in Expo for Offline React Native Apps
Storing JSON in Postgres Using Node.js
Streaming SQL in Node.js
Rate Limiting
Docker over SSH
Query Nested Data in Postgres Using Node.js
Storing JSON in Postgres Using Node.js
Re:The easiest way to query Postgres in Node.js
on Friday September 27, 2019 @11:12AM (#21092831)
That looks like a pretty cool project. I wonder how much work it would be to integrate with https://www.atdatabases.org/ to get the proper protection from SQL Injection.
The easiest way to query Postgres in Node.js
Re:SQL Injection in Node.js
on Tuesday July 30, 2019 @01:15PM (#20566903)
Yes, as it says in the article. The tag returns a class that's an instance of SQLQuery. All the @databases clients only accept SQLQuery instances and don't accept strings. This means you get a runtime error if you're using JavaScript, and a type error at build time if you're using TypeScript.
Re:SQL Injection in Node.js
on Monday July 29, 2019 @08:50AM (#20554030)
No, the point is that people do write code that is unsafe. A cursory glance at recent stack overflow questions tagged with "node.js" and "sql" shows many questions and answers with SQL Injection vulnerabilities.
By providing an API that makes it virtually impossible to create an SQL Injection vulnerability, we can allow novices to write code safely. Once you know what the `sql` tag is doing, it's really easy to review the code and be confident it isn't vulnerable.