SQL Injection using Knex raw() or whereRaw() functions

Description

Untrusted input concatenated with raw SQL query using knex raw() or whereRaw() functions can result in SQL Injection.

javascript

const knex = require('knex')({ client: 'pg' });
const query = 'SELECT * FROM users WHERE name = \' + req.query.name + '\';
knex.raw(query);

javascript

const knex = require('knex')({ client: 'pg' });
const query = 'SELECT * FROM users WHERE name =?';
knex.raw(query, [req.query.name]);

Use parameterized queries or prepared statements to prevent user input from being executed as SQL code.