SQL Injection Prevention in Prisma 6

Overview

SQL injection is one of the most critical security vulnerabilities in database applications. In Prisma 6, raw SQL queries must be written using $queryRaw tagged templates for automatic parameterization. NEVER use $queryRawUnsafe with user input.

Critical Rules

1. ALWAYS Use $queryRaw Tagged Templates

const email = userInput;

const users = await prisma.$queryRaw`
  SELECT * FROM "User" WHERE email = ${email}
`;

Prisma automatically parameterizes ${email} to prevent SQL injection.