Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

148
Views
How do I prevent sql injection on a WHERE IN request with parameterized query?

This is a next application and I am using postgresql for my db. I am used to write my requests like so :

export const getOneCourse = (courseId: string): Promise<Course> => {
  let sql = `SELECT title, description, category, techno FROM courses where courseid = $1`
  return new Promise((resolve, reject) => {
    pool.query(sql, [courseId], (err, result) => {
      if (err) reject(err);
      resolve(result);
    });
  });
};

But when I want to use the WHERE id IN ('1', '2', '5'), to fetch data corresponding to several courses ids, i can't seem to find the right syntax for the parameter. I have tried those :

SELECT something FROM table WHERE id IN $1
SELECT something FROM table WHERE id IN ($1)

the only thing that works so far is

`SELECT * FROM courses WHERE category = $1 AND courseid IN (${coursesId})`;

but does anyone know of a parameter that would allow me to avoid using the array of ids directly ? Thank you !

about 4 years ago · Juan Pablo Isaza
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!