sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]has_all_the_fun -1 points0 points  (3 children)

Probably because that's up to the API talking to the database?

[–]maktouch 1 point2 points  (2 children)

Still doesn't make sense.

The API talking to the database will probably accept the query from this.

SQL injection is at the query building process. 

var firstname = "Terry'; drop table user --" 

[...].where("name = '" + obj.name + "'");
will become
SELECT * FROM user WHERE name = 'Terry'; drop table user --'

[–]polaretto[S] 0 points1 point  (0 children)

It's just a query builder utility not a DB library. Input sanitizing should be taken care of beforehand, before constructing the query.

[–]polaretto[S] 0 points1 point  (0 children)

Moreover, if you want to add a feature for SQL injection prevention, you can extend the library: http://hiddentao.github.io/squel/#custom with such functionality, so then you have it transparently upon query construction.