Skip to content

Commit

Permalink
Apply suggestions from docs review from (@janpio)
Browse files Browse the repository at this point in the history
Co-authored-by: Jan Piotrowski <[email protected]>
  • Loading branch information
joshbouncesecurity and janpio authored Mar 26, 2024
1 parent 228aa83 commit da574ab
Showing 1 changed file with 3 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ For relational databases, Prisma Client exposes four methods that allow you to s
- `$queryRawUnsafe` to return actual records (for example, using `SELECT`) using a raw string.
- `$executeRawUnsafe` to return a count of affected rows (for example, after an `UPDATE` or `DELETE`) using a raw string.

The methods with "Unsafe" in the name are a lot more flexible but are at **significant risk of making your code vulnerable to SQL injection**.
The methods with "Unsafe" in the name are a lot more flexible but are at **significant risk of making your code vulnerable to SQL injection**.

The other two methods are safe to use with a simple template tag, no string building, and no concatenation. **However**, caution is required for more complex use cases as it is still possible to introduce SQL injection if these methods are used in certain ways. For more details, see the [SQL injection prevention](#sql-injection-prevention) section below.
The other two methods are safe to use with a simple template tag, no string building, and no concatenation. **However**, caution is required for more complex use cases as it is still possible to introduce SQL injection if these methods are used in certain ways. For more details, see the [SQL injection prevention](#sql-injection-prevention) section below.

> **Note**: All methods in the above list can only run **one** query at a time. You cannot append a second query - for example, calling any of them with `select 1; select 2;` will not work.
Expand Down Expand Up @@ -210,7 +210,7 @@ prisma.$queryRawUnsafe(
> **Note**: Prisma sends JavaScript integers to PostgreSQL as `INT8`. This might conflict with your user-defined functions that accept only `INT4` as input. If you use a parameterized `$queryRawUnsafe` query in conjunction with a PostgreSQL database, update the input types to `INT8`, or cast your query parameters to `INT4`.
For more details on using parameterised queries, see the [parameterized queries](#parameterized-queries) section below.
For more details on using parameterized queries, see the [parameterized queries](#parameterized-queries) section below.
#### Signature
Expand Down

0 comments on commit da574ab

Please sign in to comment.