From da574ab266c89c2a1e698d08345ac81e75e935e0 Mon Sep 17 00:00:00 2001 From: "Josh Grossman (Bounce Security)" <97975715+joshbouncesecurity@users.noreply.github.com> Date: Tue, 26 Mar 2024 16:55:20 +0200 Subject: [PATCH] Apply suggestions from docs review from (@janpio) Co-authored-by: Jan Piotrowski --- .../100-queries/090-raw-database-access/050-raw-queries.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/200-orm/200-prisma-client/100-queries/090-raw-database-access/050-raw-queries.mdx b/content/200-orm/200-prisma-client/100-queries/090-raw-database-access/050-raw-queries.mdx index a54c0cd9dc..485879f3a9 100644 --- a/content/200-orm/200-prisma-client/100-queries/090-raw-database-access/050-raw-queries.mdx +++ b/content/200-orm/200-prisma-client/100-queries/090-raw-database-access/050-raw-queries.mdx @@ -28,9 +28,9 @@ For relational databases, Prisma Client exposes four methods that allow you to s - `$queryRawUnsafe` to return actual records (for example, using `SELECT`) using a raw string. - `$executeRawUnsafe` to return a count of affected rows (for example, after an `UPDATE` or `DELETE`) using a raw string. - The methods with "Unsafe" in the name are a lot more flexible but are at **significant risk of making your code vulnerable to SQL injection**. +The methods with "Unsafe" in the name are a lot more flexible but are at **significant risk of making your code vulnerable to SQL injection**. - The other two methods are safe to use with a simple template tag, no string building, and no concatenation. **However**, caution is required for more complex use cases as it is still possible to introduce SQL injection if these methods are used in certain ways. For more details, see the [SQL injection prevention](#sql-injection-prevention) section below. +The other two methods are safe to use with a simple template tag, no string building, and no concatenation. **However**, caution is required for more complex use cases as it is still possible to introduce SQL injection if these methods are used in certain ways. For more details, see the [SQL injection prevention](#sql-injection-prevention) section below. > **Note**: All methods in the above list can only run **one** query at a time. You cannot append a second query - for example, calling any of them with `select 1; select 2;` will not work. @@ -210,7 +210,7 @@ prisma.$queryRawUnsafe( > **Note**: Prisma sends JavaScript integers to PostgreSQL as `INT8`. This might conflict with your user-defined functions that accept only `INT4` as input. If you use a parameterized `$queryRawUnsafe` query in conjunction with a PostgreSQL database, update the input types to `INT8`, or cast your query parameters to `INT4`. -For more details on using parameterised queries, see the [parameterized queries](#parameterized-queries) section below. +For more details on using parameterized queries, see the [parameterized queries](#parameterized-queries) section below. #### Signature