Query parameterization for safety in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use query parameterization?

Why is query parameterization important when working with databases in Node.js?

A It prevents SQL injection by separating code from data inputs.

B It encrypts the database connection for security.

C It allows queries to be written without any syntax rules.

D It makes queries run faster by caching results automatically.

💡 Hint

Think about how user input can affect database commands.

Query parameterization helps keep user data separate from SQL commands, stopping attackers from injecting harmful code.

❓ component_behavior

intermediate

Output of parameterized query execution

Given the following Node.js code using a parameterized query, what will be the output if the user input is "O'Reilly"?

Node.js

const userInput = "O'Reilly";
const query = 'SELECT * FROM authors WHERE last_name = ?';
db.execute(query, [userInput], (err, results) => {
  if (err) throw err;
  console.log(results);
});

A The query throws a syntax error due to the apostrophe in the input.

B The query runs successfully and returns authors with last name O'Reilly.

C The query returns no results because the input is ignored.

D The query causes a runtime error because parameters are not supported.

💡 Hint

How does parameterization handle special characters like apostrophes?

Parameterization safely escapes special characters, so the query runs without syntax errors and returns matching results.

📝 Syntax

advanced

Identify the correct parameterized query syntax

Which of the following Node.js code snippets correctly uses parameterized queries with the mysql2 library?

A db.execute('SELECT * FROM users WHERE id = $1', userId, callback);

B db.query('SELECT * FROM users WHERE id = ' + userId, callback);

C db.execute('SELECT * FROM users WHERE id = ?', [userId], callback);

D db.query('SELECT * FROM users WHERE id = ?', userId);

💡 Hint

Check how parameters are passed as an array in mysql2.

mysql2 uses '?' placeholders and an array of values for parameters in the execute method.

🔧 Debug

advanced

Find the error in this parameterized query code

What error will occur when running this Node.js code snippet using mysql2?

Node.js

const userId = 5;
db.execute('SELECT * FROM users WHERE id = ?', userId, (err, results) => {
  if (err) throw err;
  console.log(results);
});

A ReferenceError because userId is not defined.

B No error; the query runs successfully.

C SyntaxError due to missing semicolon after the query string.

D TypeError because parameters must be passed as an array, not a single value.

💡 Hint

Check the type of the second argument to execute().

mysql2 expects parameters as an array. Passing a single value causes a TypeError.

❓ state_output

expert

Result of multiple parameterized queries with async/await

Consider this async function using mysql2's promise API. What will be logged to the console?

Node.js

async function getUserData(userId) {
  const [rows1] = await db.execute('SELECT * FROM users WHERE id = ?', [userId]);
  const [rows2] = await db.execute('SELECT * FROM orders WHERE user_id = ?', [userId]);
  console.log(rows1.length, rows2.length);
}

getUserData(10);

A Two numbers showing how many users and orders exist for userId 10.

B An error because multiple awaits cannot be used in the same function.

C Undefined because rows1 and rows2 are not arrays.

D Zero and zero because the queries do not run without a callback.

💡 Hint

Think about how async/await works with promise-based query execution.

Each await pauses until the query completes, returning arrays of rows. The console logs the counts of results.