Better way to query database with array

Question

Below is my current code, however, I'm pretty sure that it sucks. It works and does the job but I think I might fall victim to SQL injection with my current solution. I'm very new to both Javascript and SQL so please forgive my stupid question.

app.post('/api/v1/relevantEvents', async (req, res) => {

    try {
        let events = req.body.cookie;
        if (!events) events = [];
        let a = "";
        for (let i = 0; i < events.length; i++) {
            a += "subject = '" + events[i] + "'";
            if (i !== events.length - 1) a += " OR ";
        }
        const allEvents = await pool.query("SELECT * FROM events WHERE subject IS NULL or " + a);
        res.json(allEvents.rows);
    } catch(err) {
        console.error(err.message);
    }
});

The body of the request is an array with values that exist in some row.

Haskaalo · Accepted Answer · 2021-04-16 18:36:27Z

2

Indeed, your SQL query is at risk of an SQL injection. Therefore, I would recommend a change to the constant allEvents assuming a is a string/text:

const allEvents = await pool.query("SELECT * FROM events WHERE subject IS NULL or $1::text", [a]);
});

edited Apr 16, 2021 at 18:36

answered Apr 16, 2021 at 18:30

Haskaalo

501 silver badge8 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Better way to query database with array

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related