Hacker News Reader

> node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...

Why the heck would you do that?

I guess for any library that accepts SQL, someone might concatenate strings rather than use the parameter handling.

The things I've seen because people don't want to learn an ORM's (or similar tech) API.

I mean that node-posgres doesn't encourage anyone to include parameter values through string concatenation, at least no more than porsager or other SQL-based clients.

Not sure what ORMs have to do with it. They do include a safe parameter substitution mechanism, but so do typical SQL-based clients.

It doesn't explicitly encourage you to do it, but it's very much right there - waiting to happen because you always just pass a string to the query function? In Postgres.js you have to use a function that is specifically named `unsafe` to do that.

Reply on news.ycombinator.com