How do parameterized queries protect Node.js applications from SQL Injection?

Short answer

Parameterized queries separate SQL code from data through placeholders ($1, ?); the database receives parameter values as literals that cannot be interpreted as code.

Explanation

Directly interpolating user input into SQL text with template literals (for example, `SELECT * WHERE name = '${input}'`) lets an attacker inject destructive commands. With parameterized queries, the database parses and builds the SQL execution plan first, then treats user input as fixed values even if it contains quotes or reserved words such as OR or DROP TABLE.

Code example

// Completely safe
await db.query("SELECT * FROM users WHERE email = $1 AND role = $2", [email, role]);

Common mistakes

• Using string interpolation with database libraries on the assumption that the inputs have already been checked.

Follow-up questions

• What is the N+1 problem in database queries, and how does DataLoader solve it in Node.js?

Sources

• OWASP — SQL Injection Prevention Cheat Sheet