SecurityCritical

Potential SQL Injection

src/api/users.ts:42

What's going on

User-controlled input is being interpolated directly into a SQL query string. An attacker who controls the query parameter could alter the query's logic and read, modify, or delete data they should not have access to.

Why it matters

SQL injection is one of the most exploited web vulnerabilities. A single vulnerable endpoint can expose the entire database — including credentials, payment data, and user records — and it is a common source of production breaches.

src/api/users.ts:42

Recommended Fix

Replace the inline query with a parameterized statement and validate the id before it ever reaches the database. A regression test is generated alongside the patch.

Before

1router.get("/users/:id", async (req: Request, res: Response) => {2  const id = req.params.id;3  const sql = `SELECT * FROM users WHERE id = ${id}`;4  const rows = await db.query(sql); // unsafe5  res.json(rows);6});

After

1router.get("/users/:id", async (req: Request, res: Response) => {2  const id = Number(req.params.id);3  if (!Number.isInteger(id) || id <= 0) {4    return res.status(400).json({ error: "invalid id" });5  }6  const sql = "SELECT * FROM users WHERE id = $1";7  const rows = await db.query(sql, [id]); // parameterized8  res.json(rows);9});

Uploaddone
Analyzedone
Finddone
Explainactive
Fixupcoming
Testupcoming
Verifyupcoming