preventing-sql-injection

Prevent SQL injection in Prisma by using $queryRaw with tagged templates instead of $queryRawUnsafe. Tagged templates automatically parameterize values, separating SQL structure from user input so attackers cannot alter query logic through malicious strings.

Yes. Use Prisma.sql for safe dynamic query composition. It parameterizes values while letting you build queries conditionally—for dynamic filters, IN clauses, or pagination—without concatenating untrusted input into SQL strings.

$queryRaw enforces parameterized queries via tagged templates, blocking injection; $queryRawUnsafe concatenates strings directly, leaving your database exposed. Replace all $queryRawUnsafe calls with $queryRaw tagged templates.

Pass user input as template values in $queryRaw`...` or compose queries with Prisma.sql. Never interpolate user data into SQL strings. For identifiers like column or table names, maintain strict allowlists and validate against them before building queries.

Yes. Prisma 6 supports parameterized raw SQL through $queryRaw tagged templates and Prisma.sql composition. Both enforce parameter separation and prevent injection in TypeScript and JavaScript backend codebases.