All database queries use parameterized queries or ORMs

SQL injection (CWE-89) remains one of the most reliably exploitable vulnerabilities in web applications, cited in OWASP API Security Top 10 2023 API10. String-concatenated queries hand attackers a direct channel into the database: they can extract the full schema, dump all rows, bypass authentication, or in some configurations execute OS commands via xp_cmdshell. NoSQL injection (CWE-943) achieves the same ends with operator injection like { $where: ... } or { $gt: '' }. ORMs and parameterized queries separate code from data at the driver level — a string from user input can never become a SQL keyword or a query operator.

Use ORM methods or parameterized placeholders for every database interaction. Never interpolate user-controlled strings into query text, including in ORDER BY clauses, table names, or JSON path expressions.

// Bad — never do this
const user = await pool.query(`SELECT * FROM users WHERE email = '${req.body.email}'`)

// Good — parameterized
const user = await pool.query('SELECT * FROM users WHERE email = $1', [req.body.email])

// Good — ORM (Prisma, Drizzle, Kysely all parameterize under the hood)
const user = await db.user.findUnique({ where: { email: req.body.email } })

// If dynamic column names are unavoidable, use an allowlist:
const SORTABLE = ['name', 'createdAt', 'email'] as const
const col = SORTABLE.includes(req.query.sort) ? req.query.sort : 'createdAt'