SQL injection and how to stop it

How the attack works

An SQL query is a piece of text that the database reads as instructions. If your code builds that text by joining strings with user input, the user is now helping to write your instructions. That is injection: user input that becomes code.

// DANGER: do not write code like this
const rollNo = req.query.roll; // typed by the user
const sql = "SELECT name, marks FROM results WHERE roll_no = '" + rollNo + "'";
const rows = await db.query(sql);

A normal student types R101 and gets one row. Now an attacker types this into the box: x' OR '1'='1 . Paste it into the string and look at the query the database receives.

-- The attacker typed:  x' OR '1'='1
SELECT name, marks FROM results WHERE roll_no = 'x' OR '1'='1'
-- '1'='1' is always true, so EVERY row comes back

The real damage can be large: reading every user's email and password hash, logging in as admin without a password, changing prices, or deleting tables. SQL injection has caused many big data leaks.

The fix: parameterised queries

A parameterised query (also called a prepared statement) sends the SQL text and the values separately. The SQL has placeholders where values go. The database driver sends the values on their own, so they are always treated as data, never as code, whatever quotes they contain.

// node-postgres (package "pg"): placeholders are $1, $2, ...
const { rows } = await pool.query(
  'SELECT name, marks FROM results WHERE roll_no = $1',
  [req.query.roll]
);

// mysql2: placeholders are ?
const [rows] = await connection.execute(
  'SELECT name, marks FROM results WHERE roll_no = ? AND year = ?',
  [req.query.roll, 2026]
);

An ORM (a library that builds SQL for you, like Prisma, Sequelize or Drizzle) uses parameters for normal queries, which helps a lot. But every ORM also has a way to run raw SQL. Raw queries still need placeholders, and string-building there is just as dangerous.

The same idea applies beyond SQL. NoSQL databases, shell commands and LDAP queries can be injected too. The rule is always the same: keep code and data apart.