{"action":"closed","issue":{"url":"https://api.github.com/repos/tgriesser/bookshelf/issues/604","labels_url":"https://api.github.com/repos/tgriesser/bookshelf/issues/604/labels{/name}","comments_url":"https://api.github.com/repos/tgriesser/bookshelf/issues/604/comments","events_url":"https://api.github.com/repos/tgriesser/bookshelf/issues/604/events","html_url":"https://github.com/tgriesser/bookshelf/issues/604","id":56179616,"number":604,"title":"Clarification on sanitization and security","user":{"login":"redhotvengeance","id":1249287,"avatar_url":"https://avatars.githubusercontent.com/u/1249287?v=3","gravatar_id":"","url":"https://api.github.com/users/redhotvengeance","html_url":"https://github.com/redhotvengeance","followers_url":"https://api.github.com/users/redhotvengeance/followers","following_url":"https://api.github.com/users/redhotvengeance/following{/other_user}","gists_url":"https://api.github.com/users/redhotvengeance/gists{/gist_id}","starred_url":"https://api.github.com/users/redhotvengeance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/redhotvengeance/subscriptions","organizations_url":"https://api.github.com/users/redhotvengeance/orgs","repos_url":"https://api.github.com/users/redhotvengeance/repos","events_url":"https://api.github.com/users/redhotvengeance/events{/privacy}","received_events_url":"https://api.github.com/users/redhotvengeance/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-01T21:44:08Z","updated_at":"2015-02-01T23:58:48Z","closed_at":"2015-02-01T23:58:48Z","body":"I feel like proper and automatic input sanitization for Bookshelf and Knex is being treated as a \"goes without saying\" feature, but for my own peace of mind (and since I can't find anywhere in either docs that says this explicitly):\r\n\r\nDoes Bookshelf/Knex sanitize all queries/inputs and protect against vulnerabilities like SQL injection, etc? I've found a few lines here and there in the docs that seem to imply that they do, but it's still worthwhile to know whether one needs to manually implement any security measures when building on top of these libs."}}