flawopen.com/SQL Injection in JavaScript/Knex.js

Is Knex.js safe from SQL injection?

Reference page — draft, pending review
Short answer

Its query builder methods are safe by default. Its knex.raw() escape hatch is safe only when values are passed as bindings, not interpolated into the string.

UNSAFE
knex.raw(
  `SELECT * FROM users WHERE id = ${userId}`
)
SAFE
knex('users').where(
  'id', userId
)
// or with raw + bindings:
knex.raw(
  'SELECT * FROM users WHERE id = ?',
  [userId]
)

The rule

Knex's fluent query builder (.where(), .insert(), .select()) parameterizes every value automatically. knex.raw() exists for queries the builder can't express — it stays safe only when the second argument is a bindings array, never when the SQL string itself is built with template-literal interpolation.

How to check your codebase

grep -rn "knex.raw(\`" --include="*.js" --include="*.ts" . | grep '\${'

FAQ

Is knexSnakeCaseMappers or similar plugins relevant to safety?

No — those affect naming conventions, not parameterization. Safety comes entirely from using bindings, independent of any plugin.

References