SQL Injection Prevention

# Vulnerable code (NEVER DO THIS)
const query = `SELECT * FROM users WHERE id = ${userId}`;

# Attack payload
userId = "1 OR 1=1"
# Returns ALL users

# Safe - using placeholders
const query = "SELECT * FROM users WHERE id = ?";
db.query(query, [userId], (err, results) => {
    # userId is safely escaped
});

# Named parameters
const query = "SELECT * FROM users WHERE email = :email";

# Safe PDO query
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$email]);
$user = $stmt->fetch();

# Safe - using parameters
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

# Multiple parameters
query = "INSERT INTO users (name, email) VALUES (%s, %s)"
cursor.execute(query, (name, email))

# Sequelize (Node.js)
User.findOne({ where: { email: userEmail } });

# Django ORM (Python)
User.objects.get(email=user_email)

# Eloquent (Laravel)
User::where("email", $email)->first();

# Whitelist validation
const allowedFields = ["name", "email", "age"];
if (!allowedFields.includes(sortBy)) {
    throw new Error("Invalid field");
}