sql-template-tag

parsePath(…).query is a URLSearchParams, so those parameters are just strings, and it’s an untagged template string, so it is indeed a trivial SQL injection vector. And the params argument was right there! I don’t understand quite how you make a mistake like that, but it’s extremely worrying. This is fundamental, basic stuff. The fun aspects of this are that: (a) I could actually imagine trailbase.js contents that would make it not SQL injection: you could have parsePath(…).query.get(…) return objects with a toString() that escaped SQL. This would raise even more questions, and I was sure it wouldn’t be the case, but it’s possible. (b) You could make it work safely, converting interpolation into parameters, by using a tagged template string. This could require only a tiny change: return await query( sql`SELECT Owner, Aroma, Flavor,

You can avoid this entirely with JavaScript's tagged template literals. Here is an example library: https://github.com/blakeembrey/sql-template-tag

Have you considered a tagged template literal sql builder, such as https://github.com/blakeembrey/sql-template-tag ? Keeps the SQL syntax so less to learn, but still offers parametrized queries.

Thankfully [0], it [1] already [2] exists. [3] [0] https://github.com/gajus/slonik-sql-tag-raw [1] https://github.com/felixfbecker/node-sql-template-strings [2] https://github.com/blakeembrey/sql-template-tag [3] https://www.npmjs.com/search?q=sql%20template Edit: When I first read your comment, I thought you were saying that you wanted a separate library just to have the SQL template functionality. I agree with what you're saying though.