manyuanrong / manyuanrong/sql-builder
injection ?
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 55
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
does this count as injection ?
```javascript
var s_value_entered_by_user = '1 OR 1=1';
var sql = builder
.table("a_o_user")
.where("n_id", "=", s_value_entered_by_user)
// .where("name", "like", "%n%")
.update({
s_name: "overwritten!"
})
.build();
```
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test entry point is named. Start at the TypeScript/Deno query-builder implementation behind table(), where(), update(), and build(), then inspect how the supplied value appears in the generated SQL. Done means the injection question has a clear security answer supported by the relevant behavior or a focused test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- deno, sql, typescript
- Domain
- backend, database, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100