node-mssql SQL injection warning when executing stored procedure with UPDATE statement

615 views Asked by At

I tried to execute a stored procedure in node-mssql that performs a SQL update:

Javascript code :

const request = new sql.Request();
request.input('name', sql.NVarChar, req.body.name);
request.input('id',  sql.BigInt, req.body.id);
await sql.connect(config);
await request.execute('Update_Name');

But the above code returns a SQL injection error:

{
    "code": "EINJECT",
    "name": "RequestError"
}

I can't find any reference in the docs on how to negate SQL injections when working with stored procedures?

I'm guessing my input values are the problem? I can't see from the documentation what extra steps I need to take? Or the recommend approach?

Any help would be much appreciated.

0

There are 0 answers