flawopen.com/SQL Injection in JavaScript/Sequelize

Is Sequelize query() safe from SQL injection?

Reference guide

Short answer

A query parameter is like a sealed value card: SQL receives the value separately from the query instructions. In Sequelize v6, bind sends values separately; replacements safely escapes and inserts values before sending the SQL. Building the query string with untrusted input bypasses both. Neither can stand in for a table or column name.

UNSAFE — concatenate input into SQL

sequelize.query(
  `SELECT * FROM users WHERE id = ${userId}`
)

HARDENED — bind the value separately

sequelize.query(
  "SELECT id FROM users WHERE id = $id",
  { bind: { id: userId },
    type: QueryTypes.SELECT }
)

Keep values out of SQL syntax

In Sequelize v6, replacements are escaped and inserted by Sequelize before the query reaches the database; bind values are sent separately from the SQL text. Both avoid concatenating user values into SQL, but their syntax differs by method and dialect. Parameters cannot represent table names, column names, sort directions, or arbitrary SQL fragments. Map any user-selectable query structure to a fixed application-owned allowlist. Structured model methods can parameterize ordinary values, but raw SQL helpers and literal expressions still need review.

How to audit Sequelize query construction

rg -n 'sequelize\.query\(|Sequelize\.literal\(' --glob '*.{js,ts,mjs,cjs}' .

FAQ

Are Sequelize model methods always safe from SQL injection?

Ordinary structured values in model methods are handled by Sequelize's query construction. Still review raw SQL, literal expressions, and application-built strings. Parameterization does not authorize access to a record or validate business rules.

Is Sequelize query() safe from SQL injection?

Keep values out of SQL syntax

How to audit Sequelize query construction

FAQ

References