Sequelize: SQL Injection with sequelize.query

Question

I'm using Sequelize with PostgreSQL for the first time. It's also my first time using an SQL database in a long time.

I have been researching how to improve the performance and security of some SQL Queries. I came across the sequelize.query() method and started using it for this purpose.

Is this way of making raw queries in Sequelize vulnerable to SQL Injection?

Answer 1

Although you can avoid them, you can also issue queries vulnerable to SQL Injection.

If you use exclusively queries that use Replacements or Bind Parameters for all the user entered values, you should be safe.