3 ms·
> node-postgres is ripe for sql injections because you just concatenate strings yourself when using it... Why the heck would you do that? I guess for any libr
by jmull 4y ago
> node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...
Why the heck would you do that?
I guess for any library that accepts SQL, someone might concatenate strings rather than use the parameter handling.
- heatmiser 4y agoThe things I've seen because people don't want to learn an ORM's (or similar tech) API.
- jmull 4y agoI mean that node-posgres doesn't encourage anyone to include parameter values through string concatenation, at least no more than porsager or other SQL-based clients. Not sure what ORMs have to do with it. They do include a safe parameter substitution mechanism, but so do typical SQL-based clients.
- porsager 4y agoIt doesn't explicitly encourage you to do it, but it's very much right there - waiting to happen because you always just pass a string to the query function? In Postgres.js you have to use a function that is specifically named `unsafe` to do that.