Fix SQL Injection (Legacy & Modern) in Qwik

Qwik's server-side execution model via routeLoader$ and routeAction$ provides a direct pipeline to your database. If you're concatenating raw strings inside these hooks, you're handing over your DB credentials on a silver platter. The goal is simple: decouple the SQL command from the user-supplied data using parameterized queries or type-safe ORMs.

The Vulnerable Pattern

import { routeAction$ } from '@builder.io/qwik-city';
import { createConnection } from 'mysql2/promise';
// HIGH RISK: Direct string interpolation in a server action
export const useUpdateUser = routeAction$(async (data) => {
const connection = await createConnection(process.env.DATABASE_URL);
const query = UPDATE users SET bio = '${data.bio}' WHERE id = ${data.id};
await connection.execute(query);
});

The Secure Implementation

The vulnerability exists because the database engine cannot distinguish between the SQL command and the data when using template literals. An attacker can inject ' OR 1=1 --' to bypass logic. The fix involves two layers: 1. Input Validation: Using zod$ within routeAction$ ensures data types match expectations before they hit the logic. 2. Prepared Statements: Using placeholders (?) ensures the DB driver sends the query structure and the data in separate packets, rendering payload execution impossible. For modern Qwik stacks, using Drizzle ORM or Prisma is recommended as they parameterize by default.

import { routeAction$, z, zod$ } from '@builder.io/qwik-city';
import { createConnection } from 'mysql2/promise';
// SECURE: Parameterized queries + Schema validation
export const useUpdateUser = routeAction$(
async (data) => {
const connection = await createConnection(process.env.DATABASE_URL);
const sql = ‘UPDATE users SET bio = ? WHERE id = ?’;
await connection.execute(sql, [data.bio, data.id]);
},
zod$({
id: z.number(),
bio: z.string().max(255),
})
);