Parameterized query

Learn SQL injection protection with parameterized queries.

Parameterized query

A parameterized query separates the SQL string from user data. The SQL string uses placeholders like $1, $2; the actual values are passed as a separate array.

Example: pool.query("SELECT * FROM users WHERE email = $1", [email]). This prevents SQL injection; the user data never merges with the SQL string. PostgreSQL substitutes the placeholders safely. Parameterized queries are the golden rule of database security.

Why parameterized?

A non-parameterized query is dangerous. The pattern pool.query("SELECT * FROM users WHERE name = '" + name + "'") lets a malicious name value alter the SQL. For example name = "' OR '1'='1" returns all users.

With a parameterized query this is impossible. The $1 placeholder represents a single value; it cannot change the SQL structure. Always use parameterized queries; never concatenate user data directly into SQL.

Exercise Log the query string

Define an SQL string: SELECT * FROM users WHERE id = $1. Assign it to a text variable. Log text with console.log.

Show example solution

const text = "SELECT * FROM users WHERE id = $1";
console.log(text);

Test yourself

Match each piece to its role

$1

Placeholder
values array

Parameter values
pool.query

Runs a query
SQL injection

Attack type

Complete the placeholder

const text = "SELECT * FROM users WHERE id = ____";

Show answer

const text = "SELECT * FROM users WHERE id = $1";

What does a parameterized query prevent?
- SQL enjeksiyonunu
- Memory leaks
- A CSS error
- A network slowdown
Show answer

SQL enjeksiyonunu — A parameterized query prevents SQL injection.

Next lesson: Transactions

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies