Validate, then parameterizeValidate, then parameterize

One input, two queries

Type an email or pick a payload.

SELECT * FROM users WHERE email = ?

// Bad
db.query(`SELECT * FROM users WHERE email = '${email}'`);

// Good
const user = await db.query(
  'SELECT * FROM users WHERE email = ?',
  [value.email]
);

Validate the body, answer 400

Edit a field or pick a body.

const userSchema = Joi.object({
  email: Joi.string().email().required(),
  password: Joi.string().min(8).pattern(/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/).required(),
  name: Joi.string().min(2).max(50).required()
});

app.post('/api/users', async (req, res) => {
  const { error, value } = userSchema.validate(req.body);
  if (error) {
    return res.status(400).json({ error: error.details[0].message });
  }
  const user = await db.query('SELECT * FROM users WHERE email = ?', [value.email]);
});

Test the password pattern

Type a password or pick one.

1. 8+ chars
2. A–Z
3. a–z
4. 0–9
5. @$!%*?&

/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/

/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/

password: Joi.string().min(8)
  .pattern(/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$/)
  .messages({ 'string.pattern.base': '"password" needs A-Z, a-z, 0-9 and one of @$!%*?&' })
  .required()

Why it matters, pros and cons