How to reduce SQL injection vulnerability attacks? [duplicate]

Question

How do I make the below code less vulnerable to SQL injection attacks? and also be able to accept " and ' characters in the parameters?

app.get('/addStudent',(req,res) => {
  const {fname, lname, othname, bloodType}= req.query;

  let sqlstmt = "INSERT INTO `students` (`fname`, `lname`, `othname`, `bloodtype`) VALUES ('"+fname+"', '"+lname+"', '"+othname+"', '"+bloodType+"')"
    db.query(sqlstmt,(err,result) => {
    if(err){console.log('Error occured while fetching user information',err)}
    console.log(result);
    res.send(result);
  });
});

Jannis Defu · Accepted Answer · 2020-03-27 06:36:12Z

2

You should use prepared statements which should be supported by your driver package for your chosen DBMS.

An example for MySQL: https://github.com/mysqljs/mysql#preparing-queries

answered Mar 27, 2020 at 6:36

Jannis Defu

1,4283 gold badges15 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Bill Karwin Over a year ago

Yes, but more to the point, use query parameters. Just doing a prepared statement from a string that has been formed with string-concatenation doesn't magically make it safe.

Dworo Over a year ago

how can I modify my above code using query parameters and prepared statements?

Collectives™ on Stack Overflow

How to reduce SQL injection vulnerability attacks? [duplicate]

1 Answer 1

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Linked

Related