Three SQL Injection Patterns That Still Ship in Node.js — And the ESLint Rule That Catches Them

TypeScript passed it clean. The code reviewer approved it. It shipped to production. Three months later, a penetration tester sent a report.

The vulnerable line:

const result = await pool.query(

  "SELECT * FROM orders WHERE user_id = " + req.query.userId

);

SQL injection has been a known problem for decades. OWASP A03:2021. Parameterized queries are widely understood. And it still ships — not because developers don't know, but because the three structural forms that actually appear in node-postgres codebases look harmless in code review, one line at a time. (

Has a parameterized query ever been "refactored" to concatenation in your codebase — by someone who thought they were cleaning it up? How far did it get before discovery?

→ Related: · ·