Node.js · Middle · Question 41 of 75
Why must SQL queries use parameters instead of string concatenation?
// Bad
db.query("SELECT * FROM users WHERE email = '" + email + "'");
// Good
db.query("SELECT * FROM users WHERE email = $1", [email]);- 1Concatenation doesn't work with PostgreSQL
- 2Parameters make queries return results in order
- ✓Correct answer: Parameters are sent separately from the SQL, so user input can't change the query (SQL injection)
Explanation
ORMs and query builders parameterize for you, but raw queries built from strings are still vulnerable.