sails-sql-injection.js

// Subject to SQL injection
Student.query(
  "SELECT * FROM student INNER JOIN course ON course.studentId=student.id WHERE student.id=" + req.param('student_id'),
  function(err, students) {

  }
)

// uses prepared statements to protect against sql injection
// https://github.com/brianc/node-postgres/wiki/Prepared-Statements#parameterized-queries
Student.query({
  text: "SELECT * FROM student INNER JOIN course ON course.studentId=student.id WHERE student.id=$1",
  values: [req.param('student_id')], 
}, function(err, students) {

});