flawopen.com/SQL Injection in JavaScript/TypeORM
Is TypeORM QueryBuilder safe from SQL injection?
A bound parameter is like a labeled value slot on a form: TypeORM sends the value separately, so it stays data rather than becoming SQL instructions. QueryBuilder binds named parameters when you pass them separately. Interpolating input into the condition string turns it back into SQL text.
userRepo.createQueryBuilder("u")
.where(`u.id = ${userId}`)
.getOne()
userRepo.createQueryBuilder("u")
.where("u.id = :id", { id: userId })
.getOne()
Bind values; constrain query structure
QueryBuilder.where() accepts a condition with named placeholders such as :id and a separate parameter object. Use distinct placeholder names for distinct values; TypeORM warns that reusing a name can overwrite its value. Do not interpolate user input into the condition string. Raw methods such as dataSource.query() also support driver-specific placeholders with values passed separately. Parameters bind data, not table names, column names, sort directions, or arbitrary SQL. Map any selectable structure to a fixed set of application-owned expressions.
How to audit TypeORM query construction
rg -n '(\.where\(|\.query\(|\.sql)' --glob '*.ts' .FAQ
Normal find options pass values through TypeORM query construction, but review custom operators, raw SQL expressions, and any strings assembled by application code. Parameterization prevents SQL syntax injection; it does not authorize access to a record or validate the meaning of a value.
References
- TypeORM documentation — DataSource raw queries and parameters
- OWASP — SQL Injection Prevention Cheat Sheet
- TypeORM documentation — Select Query Builder and parameters
- flawopen.com — SQL Injection in JavaScript