Node.js Web Development - Fourth Edition

Denying SQL injection attacks

SQL injection is another large class of security exploits, where the attacker puts SQL commands into input data. See https://www.xkcd.com/327/ for an example.

The sql-injection package scans query strings, request body parameters, and route parameters for SQL code. 

Install with:

$ npm install sql-injection --save

Then install it in app.mjs:

import sqlinjection from 'sql-injection';...app.use(sqlinjection);