I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. So, I did some Googling but didn't find any convincing solution just like PreparedStatement in Java.

In that case following options came to my mind with their respective concerns

  1. The DB approach mentioned in the database itself is with protection against SQL Injection
    Concern: Sorry to put this option, as I haven't tested it against SQL Injection. So just need to confirm whether my assumption is true or not.
  2. Already provided approach
    Concern: If any other approach is already provided then please let me know, as I am naive to Jaggerjs and trying out all the examples
  3. To build own API which would work like PrepredStatemet of Java with parameterized enforcing strict type checking and protect against SQL Injection
    Concern: What all character escaping I need to do to protect against SQL Injection just like we do with Cross Site Scripting issue by doing HTML encoding?

    Here I have successfully executed some encryption algorithms using their already existing Java implementation, if in this way I need to contribute and create own API please let me know, I would like to make it as an opensource library for Jaggeryjs. This API then will contain the protection against OWASP top 10 attacks to develop secure products with secure coding standards.
  • 1
    What is your question? Sorry but I can't figure out what you are asking. – Neil Smithline Aug 25 '15 at 21:43
  • Why don't you test it yourself to see if it is vulnerable to SQL injection? – mcgyver5 Aug 25 '15 at 22:31
  • db.query("SELECT * FROM person WHERE id=? AND name=? AND gender=?", personId, personName, gender); something like that should produce querying with prepared statement. – Cthulhu Aug 26 '15 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.