SQL Injection Prevention

Detect and fix SQL injection vulnerabilities across any framework. This is Finding #1 from Malaysian PDPA court cases -- the most common and most dangerous vulnerability.

The Rule

NEVER concatenate user input into SQL strings. ALWAYS use parameterized bindings.

Detection Patterns

Node.js / TypeScript

BAD (vulnerable):

// Template literal injection
const result = await db.query(`SELECT * FROM users WHERE id = '${userId}'`);

// String concatenation
const result = await db.query("SELECT * FROM users WHERE name = '" + name + "'");