ArchCase

Design · Practice · Interview

Главная

Туториалы

Карточки

Loading…

SQL Injection via String Concatenation

SQLsenior

Практика →

Main had a single `findById` using a parameterized query — a textbook example. A teammate opens a PR adding `searchUsers` and `deleteUserByName` for a new admin panel. You are the security champion. Walk the diff and find every injection.

PR: lesson.typescript +19 −04 проблем

11 import { pool } from './db'

22 import type { User } from './types'

4+export async function searchUsers(

5+ emailQuery: string,

6+ role: string,

7+ sortBy: string,

8+): Promise<User[]> {

9+ const sql = `

10+ SELECT * FROM users

11+ WHERE email LIKE '%${emailQuery}%'

12+ AND role = '${role}'

13+ ORDER BY ${sortBy}

14+ `

15+ const { rows } = await pool.query(sql)

16+ return rows

17+}

18+

19+export async function deleteUserByName(name: string): Promise<void> {

20+ await pool.query(`DELETE FROM users WHERE name = '${name}'`)

21+}

22+

423 export async function findById(id: string): Promise<User | null> {

524 const { rows } = await pool.query(

625 'SELECT * FROM users WHERE id = $1',

726 [id],

827 )

928 return rows[0] ?? null

1029 }

Шаг 1 из 6

SQL injection: what it is and how to spot it

SQL injection happens when user input ends up inside a SQL query as **code** instead of as a **parameter value**. Any string concatenation + SQL = potential injection. Red flags in code: - Template literals with `${...}` inside SQL - `.replace`, `+` used to build queries - Any user input that reaches SQL without going through `$1/$2/?` Walk the code and find every place where user data lands in a SQL string.