SQL Injection Documentation not clear

Maybe it’s just not clear for me but I’m confused on this section ES6 Tagged template literals const sql = require(‘mssql’)

sql.connect(config).then(() => { return sql.queryselect * from mytable where id = ${value} }).then(result => { console.dir(result) }).catch(err => { // … error checks })

sql.on(‘error’, err => { // … error handler }) All values are automatically sanitized against sql injection.

and

SQL injection This module has built-in SQL injection protection. Always use parameters to pass sanitized values to your queries.

const request = new sql.Request() request.input(‘myval’, sql.VarChar, ‘-- commented’) request.query(‘select @myval as myval’, (err, result) => { console.dir(result) })

What one is the preferred “best practice” to use? Or does it not matter and they both accomplish the same thing? Obviously I’m concerned with SQL Injection.

[patriksimek]

@blaskovicz Can you please open a separate issue for that with a sample code to reproduce the problem? Thank you?

Regarding this issue - I’ll update docs with a clear statement that tagged template literals are sanitized as well.

[tracker1]

the tagged template method creates a parameterized query that is protected from SQL injection…

sql.query`  

the backtick is right after the name of the function that will process the string with parameters

Both will give you the same result, I find the tagged template literals are easier to grasp… also, if you are working with a recent (8+) node version, you can use async functions, and just await the query…

const baz = await getBaz(); // should return a primative value
const results = await sql.query`
    SELECT *
    FROM foo
    WHERE foo.bar = ${baz}
`;

I much prefer the syntax above, it’s just so close to direct SQL, and sending in parameters.