# sql-sanitizer

> SQL injection request filter for Express/Fastify/Koa/Nest with presets, stats, CLI scanner, and parameterized sql helpers.

Latest version **2.0.0** (published 2026-08-15) · MIT license · 0 weekly downloads

## Install

```sh
npm install sql-sanitizer
pnpm add sql-sanitizer
yarn add sql-sanitizer
bun add sql-sanitizer
```

Provides the command `sql-sanitizer`.

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 2.0.0 |
| Published | 2026-08-15 |
| First published | 2021-11-26 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=14 |
| Dependencies | 0 |
| Unpacked size | 72.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 2 |
| Author | Wahidul Alam, Tanmoy Barua, Shuva Mai Paul, Umma Zannath Rishad |
| Maintainers | tanmoy43, paulshuvom, ummazannath, wahidul_alam |
| Keywords | sql, sql-injection, express, fastify, koa, nestjs, middleware, security, waf |

## Links

- npm: https://www.npmjs.com/package/sql-sanitizer
- Repository: https://github.com/Tanmoy-Barua/sql-sanitizer
- Homepage: https://github.com/Tanmoy-Barua/sql-sanitizer#readme
- Issues: https://github.com/Tanmoy-Barua/sql-sanitizer/issues
- npm.io page: https://npm.io/package/sql-sanitizer

## Alternatives

- [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads
- [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads
- [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads
- [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads
- [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads

## Recent versions

- 2.0.0 (latest) — 2026-08-15
- 1.3.0 — 2026-08-14
- 1.2.0 — 2026-08-14
- 1.0.0 — 2021-11-26

## README

# sql-sanitizer

[![npm version](https://img.shields.io/npm/v/sql-sanitizer.svg)](https://www.npmjs.com/package/sql-sanitizer)
[![node](https://img.shields.io/node/v/sql-sanitizer.svg)](https://nodejs.org)
[![CI](https://github.com/Tanmoy-Barua/sql-sanitizer/actions/workflows/ci.yml/badge.svg)](https://github.com/Tanmoy-Barua/sql-sanitizer/actions/workflows/ci.yml)
[![license](https://img.shields.io/npm/l/sql-sanitizer.svg)](./LICENSE)

SQL injection **request filter** for **Express / Fastify / Koa / Nest**, with presets, stats/Prometheus, a CI concat scanner, and parameterized `sql` / `sqlQ` helpers.

> Heuristic middleware is a supplement — always use parameterized queries for real safety.

## Install

```bash
npm install sql-sanitizer
```

## Quick start (Express)

```js
const express = require('express');
const sqlSanitizer = require('sql-sanitizer');
const { sql } = sqlSanitizer;

const app = express();
app.set('trust proxy', 1);
app.use(express.json());
app.use(sqlSanitizer({
  preset: 'api',
  trustProxy: 1,
  statsRoute: '/__sql-sanitizer/stats',
}));

app.get('/users/:id', async (req, res) => {
  const q = sql`SELECT * FROM users WHERE id = ${req.params.id}`;
  res.json(q);
});
```

## Adapters

```js
// Fastify
fastify.addHook('preHandler', sqlSanitizer.fastify({ preset: 'api' }));
// or: await fastify.register(sqlSanitizer.fastifyPlugin({ preset: 'graphql' }));

// Koa
app.use(sqlSanitizer.koa({ preset: 'form' }));

// NestJS (Express adapter)
consumer.apply(sqlSanitizer.nest({ preset: 'api' })).forRoutes('*');
```

## Presets

| Preset | Intent |
|--------|--------|
| `api` | Balanced API defaults + rate limit |
| `form` | Allows common free-text fields (`bio`, `comment`, …) |
| `graphql` | Stricter sensitivity for GraphQL bodies |

## Stats & Prometheus

```js
const mw = sqlSanitizer({ statsRoute: '/__sql-sanitizer/stats', statsToken: 'secret' });
app.use(mw);
// GET /__sql-sanitizer/stats  (header x-sql-sanitizer-token: secret)
// GET /__sql-sanitizer/stats?format=prometheus
mw.prometheus(); // text exposition
```

## CI scanner

```bash
npx sql-sanitizer scan .
npx sql-sanitizer scan ./src --json
```

Exit code `2` when potential unsafe SQL concatenation is found.

## Trusted proxy

```js
sqlSanitizer({ trustProxy: false }); // ignore X-Forwarded-For (anti-spoof)
sqlSanitizer({ trustProxy: 1 });     // one proxy hop
sqlSanitizer({ trustProxy: true });  // trust CDN / XFF / CF-Connecting-IP
```

## Examples

See [`examples/`](./examples) — Postgres-style, MySQL-style, and before/after demo.

## Changelog

See [CHANGELOG.md](./CHANGELOG.md).

## License

MIT

---
_Source: https://npm.io/package/sql-sanitizer · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._