Protecting Node.js Applications from Common Security Vulnerabilities

A login form that pastes the typed email address into an SQL string will let anyone log in as the administrator without a password. The input that does it is short: admin@example.com' OR '1'='1. Most attacks on web applications work the same way. The application treats text from a user as part of something it executes, such as an SQL query or an HTML page, or it trusts a request only because the browser attached a cookie.

The examples below belong to the account app from the earlier lessons in this chapter, now with a MySQL database, a comments page and a money transfer form