Skip to content

Commit

Permalink
Update based on requests from @janpio
Browse files Browse the repository at this point in the history
  • Loading branch information
joshbouncesecurity authored Mar 26, 2024
1 parent 028c28f commit 228aa83
Showing 1 changed file with 10 additions and 10 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,17 @@ Raw queries are available for all relational databases Prisma ORM supports. In a

## Raw queries with relational databases

For relational databases, Prisma Client exposes four methods that allow you to send raw queries. The methods with "Unsafe" in the name are a lot more flexible but are at **significant risk of making your code vulnerable to SQL injection**. The other two methods are safe to use with a simple template tag, no string building, and no concatenation. However, caution is required for more complex use cases as it is still possible to introduce SQL injection if these methods are used in certain ways. For more details, see the [SQL Injection](#sql-injection) section below.

You can use:
For relational databases, Prisma Client exposes four methods that allow you to send raw queries. You can use:

- `$queryRaw` to return actual records (for example, using `SELECT`).
- `$executeRaw` to return a count of affected rows (for example, after an `UPDATE` or `DELETE`).
- `$queryRawUnsafe` to return actual records (for example, using `SELECT`) using a raw string.
- `$executeRawUnsafe` to return a count of affected rows (for example, after an `UPDATE` or `DELETE`) using a raw string.

The methods with "Unsafe" in the name are a lot more flexible but are at **significant risk of making your code vulnerable to SQL injection**.

The other two methods are safe to use with a simple template tag, no string building, and no concatenation. **However**, caution is required for more complex use cases as it is still possible to introduce SQL injection if these methods are used in certain ways. For more details, see the [SQL injection prevention](#sql-injection-prevention) section below.

> **Note**: All methods in the above list can only run **one** query at a time. You cannot append a second query - for example, calling any of them with `select 1; select 2;` will not work.
### <inlinecode>$queryRaw</inlinecode>
Expand Down Expand Up @@ -58,7 +60,7 @@ const result = await prisma.$queryRaw(

<Admonition type="warning">

If you use string building to incorporate untrusted input into queries passed to this method, then you open up the possibility for SQL injection attacks. SQL injection attacks can expose your data to modification or deletion. For more information on this risk, see the [SQL Injection](#sql-injection) section below.
If you use string building to incorporate untrusted input into queries passed to this method, then you open up the possibility for SQL injection attacks. SQL injection attacks can expose your data to modification or deletion. The prefered mechanism would be to include the text of the query at the point that you run this method. For more information on this risk and also examples of how to prevent it, see the [SQL injection prevention](#sql-injection-prevention) section below.

</Admonition>

Expand Down Expand Up @@ -184,7 +186,7 @@ The `$queryRawUnsafe` method allows you to pass a raw string (or template string
If you use this method with user inputs (in other words, `SELECT * FROM table WHERE columnx = ${userInput}`), then you open up the possibility for SQL injection attacks. SQL injection attacks can expose your data to modification or deletion.<br /><br />
Wherever possible you should use the `$queryRaw` query instead, taking into account that this method can also be made vulnerable in certain circumstances. For more information, see the [SQL Injection](#sql-injection) section below.
Wherever possible you should use the `$queryRaw` method instead. When used correctly `$queryRaw` method is significantly safer but note that the `$queryRaw` method can also be made vulnerable in certain circumstances. For more information, see the [SQL injection prevention](#sql-injection-prevention) section below.
</Admonition>
Expand Down Expand Up @@ -237,9 +239,7 @@ const result: number =
<Admonition type="warning">
If you use string building to incorporate untrusted input into queries passed to this method, then you open up the possibility for SQL injection attacks. SQL injection attacks can expose your data to modification or deletion.<br /><br />
For more information on this risk, see the [SQL Injection](#sql-injection) section below.
If you use string building to incorporate untrusted input into queries passed to this method, then you open up the possibility for SQL injection attacks. SQL injection attacks can expose your data to modification or deletion. The prefered mechanism would be to include the text of the query at the point that you run this method. For more information on this risk and also examples of how to prevent it, see the [SQL injection prevention](#sql-injection-prevention) section below.
</Admonition>
Expand Down Expand Up @@ -299,7 +299,7 @@ The `$executeRawUnsafe` method allows you to pass a raw string (or template stri
If you use this method with user inputs (in other words, `SELECT * FROM table WHERE columnx = ${userInput}`), then you open up the possibility for SQL injection attacks. SQL injection attacks can expose your data to modification or deletion.<br /><br />
Wherever possible you should use the `$executeRaw` query instead, taking into account that this method can also be made vulnerable in certain circumstances. For more information, see the [SQL Injection](#sql-injection) section below.
Wherever possible you should use the `$executeRaw` method instead. When used correctly `$executeRaw` method is significantly safer but note that the `$executeRaw` method can also be made vulnerable in certain circumstances. For more information, see the [SQL injection prevention](#sql-injection-prevention) section below.
</Admonition>
Expand Down Expand Up @@ -522,7 +522,7 @@ The database will thus provide a `String` representation of your data which Pris
For details of supported Prisma types, see the [Prisma connector overview](/orm/overview/databases) for the relevant database.
## SQL injection
## SQL injection prevention
The ideal way to avoid SQL injection in Prisma Client is to use the ORM models to perform queries wherever possible.
Expand Down

0 comments on commit 228aa83

Please sign in to comment.