{"action":"created","issue":{"url":"https://api.github.com/repos/sequelize/sequelize/issues/1608","labels_url":"https://api.github.com/repos/sequelize/sequelize/issues/1608/labels{/name}","comments_url":"https://api.github.com/repos/sequelize/sequelize/issues/1608/comments","events_url":"https://api.github.com/repos/sequelize/sequelize/issues/1608/events","html_url":"https://github.com/sequelize/sequelize/issues/1608","id":31052575,"number":1608,"title":"Prepared Statements and Security","user":{"login":"noah-goodrich","id":393414,"avatar_url":"https://avatars.githubusercontent.com/u/393414?v=3","gravatar_id":"","url":"https://api.github.com/users/noah-goodrich","html_url":"https://github.com/noah-goodrich","followers_url":"https://api.github.com/users/noah-goodrich/followers","following_url":"https://api.github.com/users/noah-goodrich/following{/other_user}","gists_url":"https://api.github.com/users/noah-goodrich/gists{/gist_id}","starred_url":"https://api.github.com/users/noah-goodrich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noah-goodrich/subscriptions","organizations_url":"https://api.github.com/users/noah-goodrich/orgs","repos_url":"https://api.github.com/users/noah-goodrich/repos","events_url":"https://api.github.com/users/noah-goodrich/events{/privacy}","received_events_url":"https://api.github.com/users/noah-goodrich/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/sequelize/sequelize/labels/feature","name":"feature","color":"0b02e1"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2014-04-08T08:42:41Z","updated_at":"2015-04-12T20:23:40Z","closed_at":null,"body":"According to https://github.com/sequelize/sequelize/issues/998, the issue of prepared statements and parameter binding through the native mysql driver was considered and rejected previously.\r\n\r\nI would like to reopen the issue as a security concern for queries being run against the server. \r\n\r\nFrameworks in other languages use bound parameters natively because it is inherently more secure than doing the escaping in the framework and passing pure strings to the mysql server to process. \r\n\r\nCan you explain the justification for not using prepared statements by default in Sequelize for security purposes?"},"comment":{"url":"https://api.github.com/repos/sequelize/sequelize/issues/comments/92119900","html_url":"https://github.com/sequelize/sequelize/issues/1608#issuecomment-92119900","issue_url":"https://api.github.com/repos/sequelize/sequelize/issues/1608","id":92119900,"user":{"login":"janmeier","id":1210224,"avatar_url":"https://avatars.githubusercontent.com/u/1210224?v=3","gravatar_id":"","url":"https://api.github.com/users/janmeier","html_url":"https://github.com/janmeier","followers_url":"https://api.github.com/users/janmeier/followers","following_url":"https://api.github.com/users/janmeier/following{/other_user}","gists_url":"https://api.github.com/users/janmeier/gists{/gist_id}","starred_url":"https://api.github.com/users/janmeier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janmeier/subscriptions","organizations_url":"https://api.github.com/users/janmeier/orgs","repos_url":"https://api.github.com/users/janmeier/repos","events_url":"https://api.github.com/users/janmeier/events{/privacy}","received_events_url":"https://api.github.com/users/janmeier/received_events","type":"User","site_admin":false},"created_at":"2015-04-12T20:23:40Z","updated_at":"2015-04-12T20:23:40Z","body":"I've been following this discussion on the sideline, but I feel I should give my input as well. First of all let me say that I am completely behind mick on this one. We appreciate that the issue has been brought up, but we have lots of other things to tend to - We are looking into it, but we are not going to fix it yesterday.\r\n\r\nI see the theoretical security benefit, but not much other than that.\r\n\r\nAs for performance I doubt there is much to gain. I can't see how any DBMS would implemented prepared statements that support @mdarveau's 2nd point. If the prepared statement can be used by several connections, how will the DBMS know when to garbage collect the statement? Of course it could rely on the user to explicitly call unprepare when the statement is no longer needed, but I doubt that. Pg explicitly states that prepared statements are per connection http://www.postgresql.org/docs/9.4/static/sql-prepare.html and I'm pretty sure mysql and mssql are the same.\r\n\r\nAnd thanks for your words @mdarveau  :)"}}