This lesson's interactive features are locked, please to keep using them

Fixing SQL Injection

Parameterized queries keep SQL instructions separate from untrusted values.

Database APIs let you pass user input as separate parameters instead of simply concatenating it into the query string. The database can tell code apart from data, so a parameter can't change the query's structure.

Modern SQL libraries support parameterization. There's no excuse for building queries with raw strings!

This is not safe:

db.prepare(
  `SELECT id, email, plan FROM customers WHERE email = '${email}'`,
).all();

A parameterized query fixes it:

db.prepare(`SELECT id, email, plan FROM customers WHERE email = ?`).all(email);

An attacker who provides an email like ' OR 1=1 -- will simply get an empty result, not the entire customers table.

Assignment

Bearly Secure inserts product-search input directly into a SQL string. Parameterize the search query so user input can no longer change its structure.

Reset the database and start the app.
Visit http://localhost:3000/search?q=' OR 1%3D1) -- and confirm the injected condition returns products that don't match the search text.
Parameterize the prepared SQL query searchProducts in src/products.ts:
1. Use placeholders for both LIKE values.
2. Pass the %query% pattern as data bound to the parameters.

With Bearly Secure still running, run and submit the CLI tests from the project root.