Check Text Input for SQL Injection (SQLI) Attacks in Node.js

SQL Injection (SQLI) attacks are among the most damaging of information security threats, exploiting vulnerabilities in weakly defended web infrastructure to take control of applications or systems. They are also unfortunately among the most common, and they’ve been used successfully against some of the biggest companies in the world. Detecting a SQLI attack quickly is critical in defending your website from the extensive damage it can cause. Luckily, Cloudmersive has a Security Threat Detection API just for that. You can detect SQLI attacks with ready-to-use, copy & paste code. In this article, we’ll walk through setting it up in Node.js.

The security/threat-detection/content/sql-injection/detect/string API will simply look at a text input and tell you if there was a SQL Injection attack (true), or if there wasn’t one (false) — and it will also tell you if the operation itself scanned successfully, mitigating a “false-positive” scenario.

The first step to install this SDK is to copy in the command line below:

npm install cloudmersive-security-api-client --save

You can also add the below snippet to your package.json:

"dependencies": {
    "cloudmersive-security-api-client": "^1.2.0"
  }

Once that’s taken care of, you can copy the below example Node.js code to engage the API callback function. Once you’re done, refer to figure 1 for the API call response model.

var CloudmersiveSecurityApiClient = require('cloudmersive-security-api-client');
var defaultClient = CloudmersiveSecurityApiClient.ApiClient.instance;
// Configure API key authorization: Apikey
var Apikey = defaultClient.authentications['Apikey'];
Apikey.apiKey = 'YOUR API KEY';
var apiInstance = new CloudmersiveSecurityApiClient.ContentThreatDetectionApi();
var value = "value_example"; // String | User-facing text input.
var callback = function(error, data, response) {
  if (error) {
    console.error(error);
  } else {
    console.log('API called successfully. Returned data: ' + data);
  }
};
apiInstance.contentThreatDetectionCheckSqlInjectionString(value, callback);

Figure 1. Example Value Response Model