Hello, I am just curious to know how exactly n8n is handling SQL injections. Eg: Is the POST body sent to webhook sanitized/escapted? Or are the expressions which are added to SQL query, are they internally sanitized? In short what preventive measures are in place at the moment.

Hey @MayurVirkar , this depends on how you build your workflow. For example when using the Postgres node to execute a query you could use parameters to prevent SQL injection: [image] When using expressions to include data from a webhook’s POST body directly in your queries your workflow could be s…

First, I could never get the query parameters to work. Does the above query work for you? Eg of mine [image] Never works. Another one for easy understanding [image] No idea what I am doing wrong here. Secondly, What about MySql?

Hi @MayurVirkar , the query parameter would take the key of a field, not the actual value: [image] The MySQL node doesn’t support parameters yet (so you would need to do sanitization as part of your workflow when running queries). You might however want to raise a feature request for this, seeing …

Aah!!! Awesome! @MutedJam Can we also update the documentation? Coz many people get confused with this. Maybe we can just add this image to the documentation itself.

Sure, I’ll add this as a suggestion to the documentation backlog!

SQL Injections

Questions

MayurVirkar July 13, 2022, 5:34pm 3

First, I could never get the query parameters to work. Does the above query work for you?

Eg of mine

Never works.

Another one for easy understanding

No idea what I am doing wrong here.

Secondly, What about MySql?

Topic		Replies	Views
Query parameters not working with Postgres Questions postgres	5	4263	August 31, 2022
How to use output parameter from webhook node in postgres query? Questions	8	1636	June 25, 2025
Query Parameters not working with Postgres Connection Questions	3	128	June 19, 2025
Using Postgres Parameterized query Questions data-transformation	5	4362	November 4, 2021
How to troubleshoot MySQL query with parameters? Questions	14	1117	February 14, 2025

SQL Injections

Related topics