#0301
A login endpoint accepts a username from the HTTP request body and passes it directly to a SQL query via string concatenation.
An attacker can supply a crafted username such as admin'-- or ' OR '1'='1 to bypass authentication entirely, gaining access to any account — or all accounts at once.
This is the classic SQL injection pattern and one of the most well-documented vulnerabilities in software history.
SQL injection has topped vulnerability charts for decades. A single concatenated login query can hand an attacker the entire user database — or admin access — with a single crafted request.
buildLoginQuery so the username is passed as a parameter rather than concatenated inline.sql using $1 as the placeholder and params containing the raw username.buildLoginQuery("admin'--")// BUG → sql: "...WHERE username='admin'--'"// FIX → { sql: '...WHERE username=$1', params: ["admin'--"] }
buildLoginQuery('alice')// → { sql: '...WHERE username=$1', params: ['alice'] }
sql must be exactly "SELECT id,role FROM users WHERE username=$1".params array must contain the raw (unsanitized) username as its only element.