sql-injection

library0.0.7jsnpmunverified

Express middleware that detects SQL injection attempts in query strings, route parameters, and request bodies, responding with a 403 status code. Currently at version 0.0.7 (last updated in 2016). No recent updates; relies on simple regex patterns, which may have bypass vectors. Not recommended for production. No TypeScript types, ESM, or CJS dual support. Last commit 2017.

security

npm install sql-injection

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQL-INJECTION

sql-injection

securityjavascriptv0.0.7

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import sqlinjection from 'sql-injection';

✗ const sqlinjection = require('sql-injection');

CommonJS require still works because package does not specify type=module. No ESM support.

sqlinjection

✓ const sqlinjection = require('sql-injection');

✗ import { sqlinjection } from 'sql-injection';

Default export, not named. Named import will fail.

sqlinjection

✓ app.use(sqlinjection);

✗ app.use(sqlinjection());

Middleware is the imported function itself, not a factory. Do not call it.

Shows how to integrate the middleware into an Express app to block SQL injection attempts.

const express = require('express'); const sqlinjection = require('sql-injection'); const app = express(); app.use(sqlinjection); app.get('/user/:id', (req, res) => { res.send('User id: ' + req.params.id); }); app.listen(3000);

Debug

Known issues

deprecatedPackage is unmaintained since 2017 and uses outdated detection patterns.

fix

Consider alternatives like express-mongo-sanitize or parameterized queries.

affects: >=0.0.0

gotchaMiddleware only checks query string, params, and body for common SQL keywords; it does not sanitize database queries or prevent all injection types.

fix

Always use parameterized queries (e.g., prepared statements) as primary defense.

affects: >=0.0.0

gotchaCan cause false positives by blocking legitimate input containing SQL keywords like 'OR' or 'SELECT'.

fix

Review and update regex patterns or use a more sophisticated solution.

affects: >=0.0.0

Errors

Common errors & fixes

Cannot find module 'sql-injection'

Package not installed or typo in require path.

fix

Run 'npm install sql-injection' in the project root.

TypeError: sqlinjection is not a function

Using `app.use(sqlinjection())` instead of `app.use(sqlinjection)`.

fix

Use `app.use(sqlinjection)` without calling it as a function.

Upgrade

Version history

0.0.7latest on npm

Audit

Dependencies

expressrequiredDesigned as Express middleware; requires Express to function.

Agent activity

16 hits · last 30 days

node

Resources

githubhttps://github.com/ghafran/sql-injection ↗

packagesql-injection ↗

homepagehttps://github.com/ghafran/sql-injection ↗