javascript - Is knex.where prone to sql injection attacks? - Stack Overflow

admin管理员组

文章数量:1304186

This is a follow up question to .

It mentions knex('table').where('description', 'like', '%${term}%') as prone to sql injection attacks. Even a ment mentions the first case as prone to injection attacks. Yet the reference provided never mentions .where being prone to injection attacks.

Is this a mistake? Why would knex allow .where to be prone to injection attacks but not .whereRaw('description like \'%??%\'', [term]) . Aren't the arguments being parameterized in both cases?

This is a follow up question to https://stackoverflow./a/50337990/1370984 .

It mentions knex('table').where('description', 'like', '%${term}%') as prone to sql injection attacks. Even a ment mentions the first case as prone to injection attacks. Yet the reference provided never mentions .where being prone to injection attacks.

Is this a mistake? Why would knex allow .where to be prone to injection attacks but not .whereRaw('description like \'%??%\'', [term]) . Aren't the arguments being parameterized in both cases?

• javascript
• sql
• knex.js

Share Improve this question Follow asked Jan 8, 2020 at 21:36 SILENTSILENT 4,27877 gold badges4242 silver badges6666 bronze badges 3

• @tadman This is a real issue? I looked at knex's where documentation and it doesn't mention it being sql injection prone. knexjs/#Builder-where In fact, the only mention of sql injection attacks is for Raw - knexjs/#Raw . This is concerning. What other features of knex are prone to sql injection attacks? – SILENT Commented Jan 8, 2020 at 22:08
• Knex maintenance here. Hi! I just wanted to mention also here that the premises of this question are all false and please ignore @tadman's ments here. One should not even use ?? binding in this case. tl;dr fake news – Mikael Lepistö Commented Jan 10, 2020 at 10:10
• @MikaelLepistö Thanks for clarifying. – tadman Commented Jan 10, 2020 at 19:48

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 11

This is a follow up question to https://stackoverflow./a/50337990/1370984 .

It mentions knex('table').where('description', 'like', '%${term}%') as prone to sql injection attacks. Even a ment mentions the first case as prone to injection attacks. Yet the reference provided never mentions .where being prone to injection attacks.

I'm knex maintainer and I have mented there that

knex('table').where('description', 'like', `%${term}%`)

is NOT vulnerable to SQL injection attacks.

Is this a mistake? Why would knex allow .where to be prone to injection attacks but not .whereRaw('description like \'%??%\'', [term]) . Aren't the arguments being parameterized in both cases?

That .whereRaw is vulnerable when you interpolate values directly to sql string (like for example ?? identifier replacement does).

Correct use for .whereRaw in this case would be for example:

.whereRaw("?? like '%' || ? || '%'", ['description', term])

Where all identifiers are quoted correctly and term is sent to DB as parameter binding.

So the answer and most of the ments added to that answer are just plain wrong.

本文标签： javascriptIs knexwhere prone to sql injection attacksStack Overflow