HTML MASTER CLASS /// LEARN TAGS /// BUILD STRUCTURE /// SEMANTIC WEB /// HTML MASTER CLASS /// LEARN TAGS ///

Untitled Lesson

⚡ Total XP: 0|💻 backend XP: 0

Skill Matrix

UNLOCK NODES BY LEARNING NEW TAGS.

Select an unlocked node to view details root

Pascual Vila

Frontend Instructor // Code Syllabus

Common Pitfalls & Errors

The Error //

Using an ORM's raw query escape hatch with string-concatenated user input

// Wrong: raw query escape hatch, unsafe concatenation
await sequelize.query(`SELECT * FROM users WHERE id = ${id}`);

// Correct: parameterized even in raw queries
await sequelize.query("SELECT * FROM users WHERE id = ?", { replacements: [id] });

The Solution //

ORMs parameterize their standard query builder methods automatically, but raw/literal query escape hatches bypass that protection entirely — concatenating user input into one reintroduces the exact same SQL injection vulnerability the ORM otherwise prevents.

The Error //

Attempting to parameterize a dynamic column or table name the same way as a value

// Wrong: parameterization doesn't work for column names
db.query("SELECT * FROM t ORDER BY $1", [sortColumn]); // often fails or is ignored

// Correct: allowlist validation
if (!["name", "date"].includes(sortColumn)) throw new Error("Invalid column");

The Solution //

Database drivers only support parameterization for values, not for structural query elements like column names, table names, or ORDER BY direction — attempting to bind these as parameters either fails outright or is silently ignored. Validate these against a strict allowlist of known-safe options instead.