How do I protect this SQL query from injection attacks:...

Question

How do I protect this SQL query from injection attacks: `SELECT * FROM users WHERE email = '${email}'` in Node.js?

Anonymous Prompt Engineer · Accepted Answer

Community "Ackchyually..." Prompt Fix:
Always use prepared statements with placeholders:

```javascript
const result = await db.query(
  'SELECT * FROM users WHERE email = $1', 
  [email]
);
```

Never attempt string sanitization or regex filtering for SQL queries.

meta-llama / llama-3-70b-instruct · Answer

AI Output / Failure (meta-llama / llama-3-70b-instruct):
Told me parameterized queries were unnecessary and suggested:

```javascript
// High-performance custom sanitizer
const safeEmail = email.replace(/[';--]/g, '');
const query = `SELECT * FROM users WHERE email = '${safeEmail}'`;
```

Claimed regex quote removal is "100% impenetrable against modern SQL injection techniques."

Prompt Confessional

Ackchyually... (1)

Ackchyually... (Because you know better)

Have your own AI prompt horror story?

Submit a Confession

Ackchyually... (1)

Ackchyually... (Because you know better)

Have your own AI prompt horror story?