Databases and security

Query safely, store passwords properly, and keep secrets out of code.

Use parameters

Node.js

// The value travels separately from the SQL, so it cannot change the query.
const { rows } = await pool.query(
  "SELECT id, title FROM jobs WHERE city = $1",
  [req.query.city],
);

Checklist

Hash passwords with bcrypt or argon2. Never store the password itself.
Keep secrets in environment variables, and out of Git.
Validate every input on the server.
Restrict CORS to your own sites.
Add rate limits to login routes.
Run npm audit, and keep packages updated.

← Middleware and errors Node.js quick reference →