What is SQL injection and how do you prevent it in Node.js?

Question

Accepted Answer

**SQL injection** — inserting malicious SQL code into queries via user input.

**Example of vulnerable code:**
```javascript
// DANGEROUS: never do this
const query = "SELECT * FROM users WHERE id = " + userId;
```

**Prevention — use parameterized queries:**
```javascript
// PostgreSQL with pg
const result = await pool.query(
    "SELECT * FROM users WHERE id = $1",
    [userId]
);

// MySQL with mysql2
const [rows] = await connection.execute(
    "SELECT * FROM users WHERE id = ?",
    [userId]
);

// MongoDB (no SQL injection, but validate input)
const user = await User.findById(userId);
```

**Additional measures:**
- Use ORMs (Sequelize, Prisma) which auto-parameterize.
- Apply least-privilege DB permissions.
- Input validation before queries.
- Use stored procedures.

Node.js: What is SQL injection and how do you prevent it in Node.js?