I need to know about prevent sql injection on NodeJS sequelize ORM-CodePudding

I am a beginner nodejs sequelize ORM. I want to know how to prevent sql injection on NodeJS sequelize ORM.

example

I have a route like http://localhost:3000/admin/video/edit/5 and controller looks like

    albumEdit: async (req, res) => {
        const editInfoId = req.params.id;
        await Movie.findOne({ where: { id: editInfoId } }).then((movie) => {
            if (movie) {
                res.render('admin/movies/edit', { title: 'Edit Movie On Page One', movie });
            }
        });
    },

now I need to know how to protect DB from SQL injection?

CodePudding user response：

Indicating { where: { id: editInfoId } } you already avoided SQL injection because Sequelize treats id value as a static string passing it as a parameter to underlying SQL query.

Using where option without any SQL-query pieces concatenated from strings when some of them passed from a non-trusted source would be a good start to avoid SQL injections.

Try to use only simple object-like conditions (like you did above) or with some combinations of operators from Sequelize.Op.