flawopen.com/SQL Injection in JavaScript/Sequelize

Is sequelize.query() safe from SQL injection?

Reference page — draft, pending review
Short answer

Only when replacements are passed as a separate option. Sequelize's standard model methods (findAll, findOne, etc.) parameterize automatically — query() is the raw-SQL escape hatch and needs the same discipline as any other language's equivalent.

UNSAFE
sequelize.query(
  `SELECT * FROM users WHERE id = ${userId}`
)
SAFE
sequelize.query(
  "SELECT * FROM users WHERE id = :id",
  { replacements: { id: userId },
    type: QueryTypes.SELECT }
)

The rule

The replacements option tells Sequelize to bind values as real query parameters, the same mechanism as the underlying driver's parameterization. Building the query with a template literal and passing no replacements bypasses that entirely — Sequelize executes exactly the string it's given.

How to check your codebase

grep -rn "sequelize.query(\`" --include="*.js" --include="*.ts" . | grep '\${'

FAQ

Are the standard model methods always safe?

Yes — findAll(), create(), and similar methods parameterize automatically regardless of the value's content. The risk is confined entirely to raw query() calls.

References