One rule
Never build SQL by joining strings with user input. Use placeholders and pass values separately.
The database driver sends the SQL shape and the user values apart. So a name, email, UPI handle, or search term stays data.
Why this matters
SQL injection happens when user input changes the meaning of your query. A login box, search box, filter, or admin route can all become risky.
Your internship repo should show that you know the safe habit. Recruiters may not run attacks, but they can read your query code.
Unsafe query
This is the pattern to remove from your project. It looks simple, but the input becomes part of the SQL command.
// Bad: Node.js + pg
const email = req.body.email;
const sql = "SELECT id, name FROM users WHERE email = '" + email + "'";
const result = await db.query(sql);Safe query
Use placeholders. In PostgreSQL with the pg package, placeholders are $1, $2, and so on. Values go in an array.
// Good: Node.js + pg
const email = req.body.email;
const sql = "SELECT id, name FROM users WHERE email = $1";
const result = await db.query(sql, [email]);Fix your feature
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done
Common mistake
Do not trust client-side checks. A user can skip your form and call your API directly with Postman, curl, or browser dev tools.
Validation is still useful for clean data. But validation is not a replacement for parameters.
Use AI carefully
Ask ChatGPT or Gemini to review one file for SQL injection. Paste the file and ask: “Find SQL queries where user input is joined into the SQL string. Suggest parameterised replacements.”
Check the answer yourself. Make sure every user-controlled value is outside the SQL string and inside the values array or parameter object.
Do this now
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 4 done