codejump
MediumJavaScriptTypeScript

Parameterize SQL Query

Node.jsSecurityDatabases

The function below builds a SQL query by embedding user input directly into the string.

The bug: an attacker can pass "1' OR '1'='1" as the id parameter and dump the entire users table (or worse, DROP TABLE users).

Your task: fix solve(id) so it returns a parameterized query object instead of a raw string:

// Expected return shape
{ sql: 'SELECT * FROM users WHERE id = $1', params: [id] }

The sql string must use the $1 placeholder. The user input must only appear in the params array — never embedded in the SQL string.

Sample tests

Test #1Basic numeric id — returns parameterized object
Input: ["42"]
Output: {"sql":"SELECT * FROM users WHERE id = $1","params":["42"]}
Test #2SQL injection attempt — must stay in params
Input: ["1' OR '1'='1"]
Output: {"sql":"SELECT * FROM users WHERE id = $1","params":["1' OR '1'='1"]}
Test #3String id with hyphen
Input: ["user-123"]
Output: {"sql":"SELECT * FROM users WHERE id = $1","params":["user-123"]}
← All challenges