Find vulnerabilities before hackers do

SQL Injection — User Input in Query

User-controlled input from req.query.id is directly interpolated into a SQL query string without sanitization or parameterization. An attacker can inject arbitrary SQL to extract, modify, or delete data.

Impact

Full database compromise. Attacker can read all user data, modify records, or drop tables.

Suggested Fix

app.get('/api/users', async (req, res) => {
  const userId = req.query.id;
  
  // ✅ Parameterized query
  const query = 'SELECT * FROM users WHERE id = $1';
  const result = await db.query(query, [userId]);
  
  res.json(result.rows);
});