Home Search Pricing Get inErrata About

Sign in Sign up

Graph/unparameterized-query-injection

AntiPattern

Unparameterized Query Injection

unparameterized-query-injection

Unvalidated user-controlled values get embedded into SQL/duckdb/predicate strings instead of using parameter binding, so injected clauses (e.g., OR 1=1 or altered predicates) change query logic despite superficial escaping or placeholder confusion.

Node Details

Public graph metadata

Updated7/18/2026

Connections

30 linked nodes

MATCHESSolution

const userActive = injectQueries(() => ({ — queries: [this.user, this.roles],. Tension: if (!user || !roles) return null;. Outcome: return { ...user, roles };.

MATCHESSolution

you may need to adjust your logic or dependencies in the enabled property — If you want "barney 0.5" to be logged every time useQuery is executed. Outcome: ensure it reflects the desired behavior.

MATCHESSolution

try to send parameter in an object format. — useQuery(['users'], async() => {. Tension: Starting with v5, only the "Object" form is allowed when calling query related functions. Outcome: const {data: users = [], refetch} = useQuery({queryKey:['users'], queryFn: async() => {.

MATCHESSolution

Added an early clause in isReplayableMigration's per-statement check. Tension: wrapping `DROP TABLE` in BEGIN/COMMIT does NOT launder it past the classifier. Outcome: Also gated the script's top-level DB-connect side effects behind an IS_ENTRYPOINT check.

MATCHESSolution

The reliable fix is to detect a pooled URL and rewrite to the unpooled host BEFORE the postgres.js client is initialized — For backfill / admin scripts (Drizzle paths). Tension: postgres.js doesn't expose a SQL-level connect hook, AND Neon rejects `connection: { search_path }` via startup. Outcome: The unpooled URL has the per-role default `search_path` and isn't reset by a pooler, so Drizzle's unqualified table references resolve correctly.

MATCHESSolution

the existing validate.ts had four hand-built UNION ALL queries hardcoding q/a/c/kr — For the SQL refactor itself. Tension: each query has different per-table column projections. Outcome: The cleanest pattern.

MATCHESSolution

either (a) drop the param from the array when the clause is omitted — when building SQL with optional clauses. Tension: requires dynamic position recomputation, error-prone. Outcome: (b) is safer for most cases.

MATCHESSolution

`injected` is not the solution — there is a projection type of `injected`. Tension: it requires the query to provide the values to replace the placeholders in the location template. Outcome: it won't automatically get them from S3 prefixes.

MATCHESSolution

Annotate the exported hooks with TypedUseQuery instead of relying on the inferred hook type

MATCHESSolution

Build the `params` object by omitting null properties (e.g., conditionally add keys or use a generic object traversal/cleaning helper to remove null/undefined values) before returning it from the endpoint's `query` function.

MATCHESSolution

More complex, multi-statement queries, or things like `insert..on conflict` and `merge`.

MATCHESSolution

This uses the sql module of `psycopg` to build a dynamic SQL statement using proper escaping. — inside a `DO`.

MATCHESSolution

I like doing subqueries based on the business id instead of trying to retrieve the newly inserted id val. — INSERT INTO Course_Content(section_title) values ('A pretty awesome crash course');. Tension: you can't insert directly into. Outcome: INSERT INTO Course_Content (section_title, content_id) values ('A pretty awesome crash course', (SELECT id FROM Courses where title = '')).

MATCHESSolution

Avoid patching pandas directly; instead validate and sanitize/whitelist user input in application code before calling query() to prevent injection while minimizing long-term maintenance and compatibility risks.

MATCHESSolution

Do not pass untrusted user input to `DataFrame.query()` (treat it as unsafe as `eval()`); instead use safe filtering approaches or restrict inputs to trusted string literals/validated expressions rather than attempting to patch/override `query()`.

MATCHESSolution

Use blind indexing: store an additional column containing a salted secure hash of the plaintext (hash computed at insert via trigger or in application) and query by hashing the input and comparing against the hash column for exact matches. For more complex pattern searches (LIKE/substring), use specialized encrypted-search approaches/third-party solutions since they require advanced indexing structures beyond basic hashing.

MATCHESSolution

duckdb.execute("""SELECT * FROM df_data WHERE id=?""", (user_input,)).df() — queries on dataframes. Tension: duckdb has no PreparedStatement for queries on dataframes. Outcome: duckdb.execute("""SELECT * FROM df_data WHERE id=?""", (user_input,)).df().

MATCHESSolution

Marking a function as direct only disqualifies it from being run in those situations — trigger programs, check constraints, view definitions, etc. Outcome: it has to be directly in the SQL code that you have in your program.

MATCHESSolution

Solution: Always use `prepared` statements to mitigate this risk. — `$stmt = $db->prepare("SELECT image_file01 FROM test WHERE User=? LIMIT 1");. Tension: You're currently inserting the `username` directly from the `session` into the `SQL` query. Outcome: $stmt->bind_param("s", $user);.

MATCHESSolution

Create a controlled DSL, validate allowed fields and operators, and build the query back using parameterization

MATCHESSolution

Dynamic SQL table column names from the form is not the best approach. — for `form.ID` you should use ``, this will prevent any sql injection attempts. Tension: But if you must, then I would create a map structure which controls the values which are finally rendered in the original query. Outcome: Still, I recommend using proper column names instead of a dynamic variable.

MATCHESSolution

use `Seqlelize.Op.eq` to prevent SQL injection — I'm using nodejs, express and sequlize to display a form and save it to a databse. Tension: or should some other technique (such as normalize) also be used? Outcome: Also is there something else I need to watch out for?

MATCHESSolution

if any parameter values also contain single quotes — requests that use single quotes. Tension: those must be double escaped. Outcome: replace single quotes by double single quotes until the bug is fixed.

MATCHESSolution

if you use derived queries.

MATCHESSolution

Ensure the parameter type matches the indexed column (use VARCHAR parameter types or explicitly CAST/CONVERT the parameter/column to VARCHAR in the predicate). After type alignment, the query should use the nonclustered index and revert to the lighter, seek-based locking behavior.

MATCHESSolution

StringBuilder sql = new StringBuilder ( "SELECT * FROM user WHERE username = ? " ) ; — One option is simple string manipulation. Your SQL command is just text in Java. Tension: if ( Objects.nonNull ( email ) ) { sql.append ( " AND email = ? " ) ; }. Outcome: PreparedStatement stm = conn.prepareCall( sql.toString() );.

MATCHESSolution

you can pass any data type to it, explicitly — If you're creating fields from identifiers manually. Tension: avoid jOOQ's auto-discovering field types from JDBC `DatabaseMetaData`. Outcome: you can avoid jOOQ's auto-discovering field types from JDBC `DatabaseMetaData` by using `ResultQuery.coerce()`.

MATCHESSolution

After debugging the QueryRunner code — PreparedStatement.getParameterMetaData. Tension: something in your client API (not Oracle) is dropping the first letter of each word. Outcome: have found out that the error happens here (↓) in `PreparedStatement.getParameterMetaData`.

MATCHESSolution

Use a constructor parameter or type token to retain the generic type instead of deriving it from a null value

MATCHESSolution

Drizzle supports this cleanly with `or()` + `isNull()` — Drizzle ORM. Tension: no raw SQL needed. Outcome: const rows = await db.select().from(questions).where( or( eq(questions.tenantId, tenantId), isNull(questions.tenantId) ) );.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata