# Safely inject SQL

**URL:** <https://discourse.nodered.org/t/safely-inject-sql/17831>\
**Category:** General\
**Tags:** database\
**Created:** [12 November 2019 10:38 UTC](https://discourse.nodered.org/t/safely-inject-sql/17831 "2019-11-12T10:38:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Meng](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@Meng](https://discourse.nodered.org/u/Meng)\
**Post date:** [12 November 2019 10:38 UTC](https://discourse.nodered.org/t/safely-inject-sql/17831/1 "2019-11-12T10:38:49Z")

</div>

How do I safely inject SQL queries in node red. I want to start with:

> function addPost(body, username) {  
> return db.query(  
> ` INSERT INTO posts (body, username) VALUES (?, ?) `,  
> [body, username],  
> );  
> }

However I guess, i am missing something because it says cannot read query from undefined. Is there a good way to do a sanity SQL check in Node-Red?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [12 November 2019 10:56 UTC](https://discourse.nodered.org/t/safely-inject-sql/17831/2 "2019-11-12T10:56:36Z")

</div>

That says that the variable db is undefined. Also I would have expected it to need a string parameter so it should be in quotes. Could you not use one of the SQL nodes rather than using javascript?

---

<div class="post-metadata">

**Author:** ![Meng](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@Meng](https://discourse.nodered.org/u/Meng)\
**Post date:** [12 November 2019 11:02 UTC](https://discourse.nodered.org/t/safely-inject-sql/17831/3 "2019-11-12T11:02:46Z")

</div>

I am looking for a node or functions to prevent SQL injections into the database. I am already using node-red-node-mysql to insert the queries. I only want to know for sure the queries are safe.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [12 November 2019 11:09 UTC](https://discourse.nodered.org/t/safely-inject-sql/17831/4 "2019-11-12T11:09:59Z")

</div>

> [@Meng](#):
>
> `INSERT INTO posts (body, username) VALUES (?, ?) ` ,

I think if you use that syntax then mysql will sanitise the query for you, but I am not 100% certain of that. Your favourite search engine and the mysql docs should be able to confirm that.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [12 November 2019 14:35 UTC](https://discourse.nodered.org/t/safely-inject-sql/17831/5 "2019-11-12T14:35:17Z")

</div>

The safest thing to do is use a [prepared statement](https://en.wikipedia.org/wiki/Prepared_statement). As these are parameterised, they are much harder to break.

> <https://stackoverflow.com/questions/8263371/how-can-prepared-statements-protect-from-sql-injection-attacks>

[https://dev.mysql.com/doc/refman/8.0/en/sql-syntax-prepared-statements.html](https://dev.mysql.com/doc/refman/8.0/en/sql-syntax-prepared-statements.html)