SQL Injection

// VULNERABLE: User input directly in SQL string
app.post('/login', async (req, res) => {
  const { username, password } = req.body;
  
  // This is the vulnerability - string concatenation
  const query = `
    SELECT * FROM users 
    WHERE username = '${username}' 
    AND password = '${password}'
  `;
  
  const user = await db.query(query);
  
  if (user.rows.length > 0) {
    res.json({ success: true, user: user.rows[0] });
  } else {
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

Username: admin' --
Password: anything

Resulting query:
SELECT * FROM users 
WHERE username = 'admin' --' 
AND password = 'anything'

The -- comments out the password check!
Attacker logs in as admin without knowing the password.

-- Original query for product search
SELECT name, price FROM products WHERE id = 1

-- Attacker input: 1 UNION SELECT username, password FROM users --
SELECT name, price FROM products WHERE id = 1 
UNION SELECT username, password FROM users --

-- Returns all usernames and passwords!

-- Boolean-based: Does the first character of admin password = 'a'?
1 AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin') = 'a'

-- Time-based: If true, sleep for 5 seconds
1; IF (SELECT COUNT(*) FROM users WHERE username='admin') > 0 
   WAITFOR DELAY '0:0:5' --

-- Attacker measures response time to extract data bit by bit

// Node.js with pg (PostgreSQL)
const query = 'SELECT * FROM users WHERE username = $1 AND password = $2';
const result = await db.query(query, [username, password]);

// Node.js with mysql2
const [rows] = await connection.execute(
  'SELECT * FROM users WHERE username = ? AND password = ?',
  [username, password]
);

// Prisma ORM - automatically parameterized
const user = await prisma.user.findFirst({
  where: {
    username: username,
    password: hashedPassword
  }
});

// Raw queries in Prisma - still safe with template
const users = await prisma.$queryRaw`
  SELECT * FROM users WHERE username = ${username}
`;