From Vulnerability Finding to Verified Patch

Category filter bypassed via SQL injection vulnerability.

The API directly concatenates the category parameter into the raw SQL query. A crafted input payload alters query semantics, bypassing the filter and returning all records in the fixture.

GET /api/products?category=books'%20OR%20'1'%3D'1

category = "books' OR '1'='1"

String concatenation mixes untrusted user input directly with executable SQL syntax. Quoting input is ineffective: an injected apostrophe terminates the literal string, and the appended OR clause evaluates to true for all rows. The correct fix decouples SQL statement structure from bound parameter values.

The concatenated query was replaced with a parameterized prepared statement. The API response contract and legitimate category filtering behavior remain unchanged.

const query = `SELECT * FROM products WHERE category = '${category}'`;
const products = await database.query(query);

const query = 'SELECT * FROM products WHERE category = ?';
const products = await database.query(query, [category]);

Executed in an isolated, in-memory SQLite test fixture. The exploit was reproduced prior to patching, and the modified query passed all four regression checks below.

• Injection payload treated as literal data0 rows
• Standard category query returns expected records1 rows
• Category with apostrophe filters correctly1 rows
• Nonexistent category returns empty array0 rows

Verified scope: this query and its four regression cases. This is not a whole-project security certification.

Dedicated Git branch prepared for this fix. Review the diff and test results before merging into main.

Example branch name for illustration; no remote customer repository was modified.