How to Prevent SQL Injection Attacks in Nodejs

Text inputs that feed directly into our web application’s SQL database queries are prime targets for SQL Injection (SQLI) attacks.

Thankfully, using the complementary Nodejs code examples below, we can take advantage of a free API that checks text inputs for SQL Injection attacks before that text is incorporated into a database query.

With a straightforward response object, we’ll be able to identify SQL injection strings and reject the input to neutralize the threat.

Let’s say, for example, a threat actor submits the following password string into a web application login form:

' OR '1'='1'; --

When submitted alongside “admin” as the username, this basic true condition can trick a (weakly configured) application into ignoring the password input entirely. This would allow the threat actor to log into the web application with admin privileges.

However, if we use the SQLI detection API to check this string, we’ll get the following response:

{
  "Successful": true,
  "ContainedSqlInjectionAttack": true,
  "OriginalInput": "' OR '1'='1'; --"
}

We can easily use the “ContainedSqlInjectionAttack” value to mitigate the attack and return an error to the client side.

We can structure our API call in two quick steps. First, let’s run the below NPM command to install the client SDK:

npm install cloudmersive-security-api-client --save

We can alternatively add the following snippet to our package.json:

  "dependencies": {
    "cloudmersive-security-api-client": "^1.2.0"
  }

Next, let’s quick grab a free Cloudmersive API key to authorize our API calls (this will allow a limit of 800 API calls per month with zero commitments).

Lastly, let’s use the below code examples to call the SQLI detection function:

var CloudmersiveSecurityApiClient = require('cloudmersive-security-api-client');
var defaultClient = CloudmersiveSecurityApiClient.ApiClient.instance;

// Configure API key authorization: Apikey
var Apikey = defaultClient.authentications['Apikey'];
Apikey.apiKey = 'YOUR API KEY';



var apiInstance = new CloudmersiveSecurityApiClient.ContentThreatDetectionApi();

var value = "value_example"; // String | User-facing text input.


var callback = function(error, data, response) {
  if (error) {
    console.error(error);
  } else {
    console.log('API called successfully. Returned data: ' + data);
  }
};
apiInstance.contentThreatDetectionCheckSqlInjectionString(value, callback);

That’s all there is to it — now we can easily take advantage of a free SQLI detection API in our Nodejs applications.