Three SQL Injection Techniques Persist in Node.js — ESLint Rule to Detect Them

TypeScript passed it clean. The code reviewer approved it. It shipped to production. Three months later, a penetration tester sent a report. The vulnerable line: const result = await pool.query( "SELECT * FROM orders WHERE user_id = " + req.query.userId ); SQL injection has been a known problem for