DataArena
Database SQL Injection Defense & Password Hashing
E-COMMERCE AUDITOR CURRICULUM14 Master Lessons

Learn the Good Patterns

Real-world engineering guide on how top e-commerce websites achieve sub-1.0s LCP, zero layout shifts, impenetrable checkout security, and effortless scale.

Explore Aura Athletics Store
Security & Secrets5 min read

Database SQL Injection Defense & Password Hashing

Safeguarding customer order records, payment sessions, and user profiles against SQL injection using parameterized queries, ORMs, and Argon2/bcrypt password hashing.

Production Benchmark (E-Commerce Standard)

Parameterized Prepared Statements & Adaptive Password Hashing

Every customer input (search query, email address, checkout voucher) is passed as a parameterized data value rather than concatenated into raw SQL strings. Customer passwords are never stored in plaintext or weak MD5 hashes; they are irreversibly hashed using Argon2id or bcrypt with high work factors.

Production Implementation Reference
// Good Pattern: Parameterized queries with pg or safe ORMs (Prisma / Drizzle)
import bcrypt from 'bcryptjs';
import { db } from '@/lib/db';

export async function registerCustomer(email, rawPassword) {
  // 1. Enforce high-factor password hash
  const saltRounds = 12;
  const passwordHash = await bcrypt.hash(rawPassword, saltRounds);

  // 2. Parameterized SQL insert ($1, $2 prevent SQL injection completely)
  const query = `
    INSERT INTO customers (email, password_hash, created_at)
    VALUES ($1, $2, NOW())
    RETURNING id, email
  `;
  const result = await db.query(query, [email.toLowerCase().trim(), passwordHash]);
  return result.rows[0];
}

Key Engineering & Business Benefits:

  • 100% immune to SQL injection attacks (OWASP Top 10 A03:2021).
  • Customer credentials remain unreadable even if a physical database backup is compromised.
  • Prevents unauthorized extraction of customer billing records, order history, and addresses.
The Bad Site Anti-Pattern

The Horror Site: String Concatenation & Plaintext Passwords

Critical (Severity 10/10)

The bad site concatenated raw user inputs into SQL strings. Entering "admin' OR '1'='1" logged an attacker into the first administrative account. Furthermore, all customer passwords were saved as unhashed plain text directly inside the database table.

// The Bad Site concatenated strings: const sql = "SELECT * FROM users WHERE email = '" + req.body.email + "' AND pwd = '" + req.body.password + "'"; // Entering: admin' OR '1'='1 -- bypassed all authentication checks!

How to Implement / Fix in 3 Practical Steps

1

Always utilize parameterized queries ($1, $2 or ?) or verified ORMs (Prisma, SQLAlchemy, Drizzle) for all database operations.

2

Hash customer passwords with Argon2id or bcrypt (cost factor >= 12); never store plaintext or outdated MD5/SHA1 hashes.

3

Enforce least-privilege database user permissions (the web app should never run as postgres/root superuser).

Auditor DevTools Inspection Tip:

Attempt logging in with email "admin' OR '1'='1". A secure site returns a generic "Invalid email or password" 401 error without revealing query syntax.

Finished reading this lesson?

Mark it as mastered below, or click Next Lesson to auto-complete.

Database SQL Injection Defense & Password Hash… · DataArena