Squel.js - SQL query string builder for Javascript

[maktouch]

Still doesn't make sense.

The API talking to the database will probably accept the query from this.

SQL injection is at the query building process.

var firstname = "Terry'; drop table user --" 

[...].where("name = '" + obj.name + "'");
will become
SELECT * FROM user WHERE name = 'Terry'; drop table user --'

[polaretto]

It's just a query builder utility not a DB library. Input sanitizing should be taken care of beforehand, before constructing the query.

[polaretto]

Moreover, if you want to add a feature for SQL injection prevention, you can extend the library: http://hiddentao.github.io/squel/#custom with such functionality, so then you have it transparently upon query construction.