flawopen.com/SQL Injection in JavaScript/Prisma

Is Prisma's $queryRaw safe?

Reference page — draft, pending review
Short answer

$queryRaw (tagged template) is safe — Prisma auto-parameterizes each interpolated value. $queryRawUnsafe is not — the name is a deliberate, explicit warning.

UNSAFE — $queryRawUnsafe
await prisma.$queryRawUnsafe(
  `SELECT * FROM users
   WHERE id = ${userId}`
)
SAFE — $queryRaw
await prisma.$queryRaw
  `SELECT * FROM users
   WHERE id = ${userId}`
// tagged template auto-parameterizes

Why they look almost identical but aren't

$queryRaw used as a tagged template literal intercepts each ${} interpolation and converts it into a real bound parameter before the query runs — this only works with the tagged-template call syntax, not a plain string. $queryRawUnsafe takes a plain string and executes it exactly as given, with zero parameterization.

How to check your codebase

grep -rn "\$queryRawUnsafe\|\$executeRawUnsafe" --include="*.ts" --include="*.js" .

FAQ

Why does $queryRawUnsafe exist at all?

For cases needing dynamic identifiers (table/column names) that can't be bound as parameters — the same allow-list rule that applies to MyBatis's ${} applies here.

References