Escape user input so you are not vulnerable to SQL injection attacks

[cchauche]

products/server/controllers/retrieveProduct.js

Lines 14 to 32 in 35408ad

	let query = `
	SELECT
	products.id,
	products.name,
	products.slogan,
	products.description,
	products.category,
	products.default_price,
	(
	SELECT jsonb_agg(jsonb_build_object(
	'feature', features.feature,
	'value', features.value
	)) AS features
	FROM features
	WHERE products.id = features.product_id
	)
	FROM products
	WHERE products.id = ${productId};
	`;

It looks like you are using sequalize's query() method which takes a raw SQL query as a string. From doing some research it seems that sequalize wont automatically escape these strings so you need to either use '?' placeholders instead of template literals to add user input to the query string. You can see this stack overflow article and take a look at the documentation for how to implement replacements here