What a Hyrax audit looks like

User-controlled input is directly concatenated into a SQL query string. An attacker could inject malicious SQL to read, modify, or delete data from the database. This is a CVSS 9.8 critical vulnerability.

async function getInvoicesByUser(userId: string) {
  const query = `
    SELECT * FROM invoices 
    WHERE user_id = '${userId}'
    ORDER BY created_at DESC
  `;
  return await db.query(query);
}

async function getInvoicesByUser(userId: string) {
  const query = `
    SELECT * FROM invoices 
    WHERE user_id = $1
    ORDER BY created_at DESC
  `;
  return await db.query(query, [userId]);
}