Query parameterization for safety in Node.js - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is query parameterization in database queries?

Query parameterization means using placeholders in SQL queries and passing actual values separately to prevent direct insertion of user input into the query string.

beginner

Why is query parameterization important for safety?

It protects against SQL injection attacks by ensuring user input is treated as data, not executable code in the database query.

intermediate

How do you use query parameterization with Node.js and the 'mysql2' library?

Use '?' as placeholders in the SQL string and pass an array of values as the second argument to the query function, e.g., connection.query('SELECT * FROM users WHERE id = ?', [userId]).

beginner

What can happen if you do NOT use query parameterization?

Your app can be vulnerable to SQL injection, allowing attackers to run harmful SQL commands, steal data, or damage your database.

intermediate

Give an example of a safe query using parameterization in Node.js with 'pg' (PostgreSQL) library.

const text = 'SELECT * FROM users WHERE email = $1'; const values = [userEmail]; client.query(text, values);

What symbol is commonly used as a placeholder in parameterized queries with 'mysql2' in Node.js?

A @

B $1

C ?

D #

The '?' symbol is used as a placeholder for parameters in 'mysql2' queries.

What is the main security risk avoided by using query parameterization?

A Cross-site scripting (XSS)

B Denial of Service (DoS)

C Man-in-the-middle attack

D SQL injection

Query parameterization prevents SQL injection by separating code from data.

In PostgreSQL queries with Node.js 'pg' library, how are parameters referenced?

A Using numbered placeholders like $1, $2

B Using '?' placeholders

C Using '@param' syntax

D Using '#' symbols

PostgreSQL uses numbered placeholders like $1, $2 for parameterized queries.

Which of these is NOT a benefit of query parameterization?

A Makes queries run faster by caching

B Prevents SQL injection

C Automatically escapes user input

D Allows dynamic query building without risk

Parameterization mainly improves security, not necessarily query speed.

What happens if user input is directly concatenated into SQL queries without parameterization?

A The query runs faster

B The app becomes vulnerable to SQL injection

C The database automatically sanitizes input

D The query fails to execute

Direct concatenation allows attackers to inject malicious SQL code.

Explain in your own words why query parameterization is important for database safety in Node.js applications.

Think about how attackers might try to trick your database.

Describe how you would write a safe SQL query using parameterization with a Node.js database library of your choice.

Remember the syntax differs slightly between libraries like mysql2 and pg.