SQL Injection Detection — ShipSafe

What is SQL Injection?

SQL injection occurs when untrusted user input is concatenated directly into SQL queries, allowing attackers to read, modify, or delete database data. It remains one of the most common and dangerous web vulnerabilities — consistently in the OWASP Top 10.

Why It Matters

A single SQL injection vulnerability can give an attacker full read access to your database — user emails, hashed passwords, payment records, everything. In the worst case, they can escalate to write access and modify or delete data, or use stacked queries and database-specific features (like xp_cmdshell on SQL Server or COPY TO PROGRAM on PostgreSQL) to execute operating system commands on the database server itself.

What ShipSafe Detects

• ✓Raw SQL queries with string concatenation or template literals containing user input
• ✓ORM bypass patterns where raw queries are used alongside an ORM (e.g., Prisma $queryRawUnsafe with concatenation)
• ✓Parameterized query misuse (e.g., wrapping interpolated values in quotes inside Prisma tagged templates, which disables parameterization)
• ✓Dynamic table and column names derived from user input — ORDER BY and table name injection
• ✓Stored procedure calls with unsanitized parameters
• ✓Second-order SQL injection where data stored from one request is later used unsafely in a query
• ✓NoSQL injection patterns in MongoDB queries ($where, $gt, $regex with user-controlled objects)

Example: Vulnerable Code

Vulnerable Express.js route with SQL injection

// Vulnerable: user input directly in SQL query
app.get("/users", async (req, res) => {
  const { search } = req.query;
  const result = await db.query(
    `SELECT * FROM users WHERE name = '${search}'`
  );
  res.json(result.rows);
});

// An attacker sends: search=' OR '1'='1' --
// The query becomes: SELECT * FROM users WHERE name = '' OR '1'='1' --'
// This returns ALL users in the database.

ShipSafe Catches It

$ shipsafe scan

  CRITICAL  sql-injection/template-literal-in-query
  src/routes/users.ts:4
  User input from req.query is interpolated directly into SQL query.
  Fix: Use parameterized queries — db.query("SELECT * FROM users WHERE name = $1", [search])

What to Do Instead

Safe alternatives: parameterized queries with pg, Prisma, and Drizzle

// SAFE: parameterized query with pg driver
app.get("/users", async (req, res) => {
  const { search } = req.query;
  const result = await db.query(
    "SELECT * FROM users WHERE name = $1",
    [search]
  );
  res.json(result.rows);
});

// SAFE: Prisma tagged template (auto-parameterizes)
const users = await prisma.$queryRaw`
  SELECT * FROM users WHERE name = ${search}
`;
// Prisma converts this to: SELECT * FROM users WHERE name = $1

// SAFE: Drizzle query builder
const users = await db
  .select()
  .from(usersTable)
  .where(eq(usersTable.name, search));

Frequently Asked Questions

Related Security Categories