• Empleos
  • Sobre nosotros
  • profesionales
    • Inicio
    • Empleos
    • Cursos y retos
    • Preguntas
    • Profesores
  • empresas
    • Inicio
    • Publicar vacante
    • Nuestro proceso
    • Precios
    • Pruebas Online
    • Nómina
    • Blog
    • Comercial
    • Calculadora de salario

0

103
Vistas
How do I prevent sql injection on a WHERE IN request with parameterized query?

This is a next application and I am using postgresql for my db. I am used to write my requests like so :

export const getOneCourse = (courseId: string): Promise<Course> => {
  let sql = `SELECT title, description, category, techno FROM courses where courseid = $1`
  return new Promise((resolve, reject) => {
    pool.query(sql, [courseId], (err, result) => {
      if (err) reject(err);
      resolve(result);
    });
  });
};

But when I want to use the WHERE id IN ('1', '2', '5'), to fetch data corresponding to several courses ids, i can't seem to find the right syntax for the parameter. I have tried those :

SELECT something FROM table WHERE id IN $1
SELECT something FROM table WHERE id IN ($1)

the only thing that works so far is

`SELECT * FROM courses WHERE category = $1 AND courseid IN (${coursesId})`;

but does anyone know of a parameter that would allow me to avoid using the array of ids directly ? Thank you !

almost 3 years ago · Juan Pablo Isaza
Responde la pregunta
Encuentra empleos remotos

¡Descubre la nueva forma de encontrar empleo!

Top de empleos
Top categorías de empleo
Empresas
Publicar vacante Precios Nuestro proceso Comercial
Legal
Términos y condiciones Política de privacidad
© 2025 PeakU Inc. All Rights Reserved.

Andres GPT

Recomiéndame algunas ofertas
Necesito ayuda