How does odbc handle sql injection

[ranjithchev]

Hi

I'm using odbc to connect to sql server from linux in my node application. I know that mssql module has built in sql injection protection when we parameterize the queries. How does it work with odbc module?

Thanks
Ranjith

[wankdanker]

Using parameters and question marks will use ODBC's internal handling of parameter replacement in SQL queries.

Example:

db.querySync('select * from users where user_id = ?', [1234]);

https://github.com/wankdanker/node-odbc#querysqlquery--bindingparameters-callback

Hope this helps.

[ranjithchev]

Thank you very much. This helps.