SQL injection risk in n8n
Why building SQL queries with string concatenation puts your database at risk
What is this issue?
SQL injection occurs when user input is directly concatenated into SQL queries instead of using parameterized queries. This allows attackers to manipulate your database queries and potentially access, modify, or delete data.
Vulnerable patterns detected:
•SELECT * FROM users WHERE id = '${id}'•String concatenation with + or template literals•User input from webhooks used directly in queries•Dynamic table or column names from external input
Why is this dangerous?
Data breach
Attackers can extract sensitive data from your entire database, including other tables you didn't intend to query.
Data manipulation
Malicious input can modify or delete data, corrupting your database integrity.
Authentication bypass
SQL injection can bypass login checks, giving attackers admin access.
Remote code execution
In some databases, SQL injection can lead to operating system command execution.
How to fix it
- 1
Use parameterized queries
In Postgres/MySQL nodes, use $1, $2, :param syntax instead of string interpolation. Pass values as parameters.
- 2
Validate and sanitize input
Before using any external input, validate it matches expected patterns (e.g., numeric ID should only contain digits).
- 3
Use ORM operations
When possible, use n8n's built-in operations (Get, Create, Update) instead of raw SQL queries.
- 4
Implement least privilege
Use database users with minimal required permissions. Don't connect with admin credentials.
Scan your workflow now
Upload your n8n workflow JSON and instantly detect SQL injection risks and other database security issues.