HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Directly interpolating a client-supplied sort field name into a raw SQL ORDER BY clause without validating it against an allowlist

// Wrong: injection risk, field name used directly
const query = `SELECT * FROM orders ORDER BY ${req.query.sort}`;

// Correct: validated against an allowlist first
if (!ALLOWED_SORT_FIELDS.includes(field)) throw new Error("Invalid sort field");

The Solution //

A sort field name is a structural part of the query, not a value — it cannot be safely parameterized the way a filter value can, making it a genuine SQL injection risk if a client-supplied field name is used directly without validation. Validate against an explicit allowlist of genuinely sortable, known-safe field names before ever including it in a query.

The Error //

Sorting only by a non-unique field with no unique tiebreaker, when the result is also paginated

// Undefined relative order among tied rows
ORDER BY status ASC

// Correct: a unique tiebreaker guarantees stable, deterministic ordering
ORDER BY status ASC, id ASC

The Solution //

Rows tied on a non-unique sort field (like status) have an undefined relative order as far as the database is concerned — combined with pagination, this can cause the same row to appear on two different pages or a row to be skipped, since the database is free to order tied rows differently between separate query executions.