Three SQL Injection Patterns That Still Ship in Node.js — And the ESLint Rule That Catches Them

TypeScript passed it clean. The code reviewer approved it. It shipped to production. Three months later, a penetration tester sent a report.

The vulnerable line:

const result = await pool.query(

"SELECT * FROM orders WHERE user_id = " + req.query.userId

);