Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Next.js

SQL injection in Next.js

highUpdated Oct 12, 2026

With Prisma, use the tagged template prisma.$queryRaw , which parameterizes interpolations. Do not use $queryRawUnsafe with a built string.

Fix for Next.js

With Prisma, use the tagged template prisma.$queryRaw, which parameterizes interpolations. Do not use $queryRawUnsafe with a built string. With postgres or pg, pass values as parameters ($1, $2), not as part of the query text.

Do not let the caller choose the column name unless you check it against a list you wrote.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.