{"action":"created","issue":{"url":"https://api.github.com/repos/felixge/node-mysql/issues/731","labels_url":"https://api.github.com/repos/felixge/node-mysql/issues/731/labels{/name}","comments_url":"https://api.github.com/repos/felixge/node-mysql/issues/731/comments","events_url":"https://api.github.com/repos/felixge/node-mysql/issues/731/events","html_url":"https://github.com/felixge/node-mysql/issues/731","id":27120442,"number":731,"title":"Security issue with param escaping?","user":{"login":"thekiur","id":1161017,"avatar_url":"https://avatars.githubusercontent.com/u/1161017?v=3","gravatar_id":"","url":"https://api.github.com/users/thekiur","html_url":"https://github.com/thekiur","followers_url":"https://api.github.com/users/thekiur/followers","following_url":"https://api.github.com/users/thekiur/following{/other_user}","gists_url":"https://api.github.com/users/thekiur/gists{/gist_id}","starred_url":"https://api.github.com/users/thekiur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thekiur/subscriptions","organizations_url":"https://api.github.com/users/thekiur/orgs","repos_url":"https://api.github.com/users/thekiur/repos","events_url":"https://api.github.com/users/thekiur/events{/privacy}","received_events_url":"https://api.github.com/users/thekiur/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/felixge/node-mysql/labels/security","name":"security","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":21,"created_at":"2014-02-07T08:42:11Z","updated_at":"2015-01-08T19:29:02Z","closed_at":null,"body":"Hi, im running node-mysql latest on node-latest.\r\nSomebody using the acunetix vulnerability scanner has triggered this error:\r\nUNKNOWN COLUMN '$acunetix' IN WHERE CLAUSE.\r\nThe query: SELECT id, email FROM accounts WHERE username = ?\r\n\r\nHow is this possible? Its very dangerous to our application, please respond quickly."},"comment":{"url":"https://api.github.com/repos/felixge/node-mysql/issues/comments/69234364","html_url":"https://github.com/felixge/node-mysql/issues/731#issuecomment-69234364","issue_url":"https://api.github.com/repos/felixge/node-mysql/issues/731","id":69234364,"user":{"login":"dresende","id":157494,"avatar_url":"https://avatars.githubusercontent.com/u/157494?v=3","gravatar_id":"","url":"https://api.github.com/users/dresende","html_url":"https://github.com/dresende","followers_url":"https://api.github.com/users/dresende/followers","following_url":"https://api.github.com/users/dresende/following{/other_user}","gists_url":"https://api.github.com/users/dresende/gists{/gist_id}","starred_url":"https://api.github.com/users/dresende/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dresende/subscriptions","organizations_url":"https://api.github.com/users/dresende/orgs","repos_url":"https://api.github.com/users/dresende/repos","events_url":"https://api.github.com/users/dresende/events{/privacy}","received_events_url":"https://api.github.com/users/dresende/received_events","type":"User","site_admin":false},"created_at":"2015-01-08T19:29:02Z","updated_at":"2015-01-08T19:29:02Z","body":"@SystemParadox: I don't think so. The report seems to be badly explained and seems to be related to constructing SQL based on user input without any check.\r\n\r\nGood usage:\r\n\r\n```js\r\ndb.query(\"SELECT * FROM users WHERE id = ?\", [ +req.params.id ], next);\r\n```\r\n\r\nNo harm on that, casting forces it to be a number. Even if it wasn't a number and the `+` was omitted, it's just fine (or else you would have problems when UPDATing columns with binary data - there's tests for that).\r\n\r\nThe problem here seems to be with something more like:\r\n\r\n```js\r\n// BAD! BAD!\r\ndb.query(\"SELECT * FROM \" + req.params.table + \" WHERE ....\", next);\r\n```"}}