<story><title>Finding an authorization bypass on my own website</title><url>https://maxwelldulin.com/BlogPost?post=9185867776</url></story><parent_chain></parent_chain><comment><author>PeterisP</author><text>The key point is that an abstraction layer trying to implement an API that looks like parametrized queries is not equivalent to actual parametrized queries where the query and parameters are kept separately, and the SQL text is parsed and execution plan is formed by the DB engine &lt;i&gt;before&lt;/i&gt; the parameters are even considered. If your DB library is inserting the parameters in a text query before sending it off to the server to be parsed as arbitrary SQL, that&amp;#x27;s not a parametrized query, but just fake smoke and mirrors.</text></comment>
<story><title>Finding an authorization bypass on my own website</title><url>https://maxwelldulin.com/BlogPost?post=9185867776</url></story><parent_chain></parent_chain><comment><author>88913527</author><text>Is there any plausible reason why mysqljs should accept anything other than a string for the parameters array (second argument)?&lt;p&gt;&lt;pre&gt;&lt;code&gt;  connection.query(&amp;quot;SELECT * FROM accounts WHERE username = ? AND password = ?&amp;quot;, [{username: {username: 1}}, &amp;quot;secret&amp;quot;]);
&lt;/code&gt;&lt;/pre&gt;
Without looking at the implementation details, I would expect this code to throw an exception. A &amp;quot;garbage in, garbage out&amp;quot; philosophy seems dangerous for a SQL statement.</text></comment>