express mysql注入

const mysql = require('mysql');
const connection = mysql.createConnection({
  host: 'localhost',
  user: 'user',
  password: 'password',
  database: 'database_name'
});

app.get('/user', (req, res) => {
  const userId = req.query.id;
  const sql = 'SELECT * FROM users WHERE id = ?';
  connection.query(sql, [userId], (error, results) => {
    if (error) throw error;
    res.send(results);
  });
});

const Joi = require('joi');

const schema = Joi.object({
  id: Joi.number().integer().required()
});

app.get('/user', (req, res) => {
  const { error } = schema.validate(req.query);
  if (error) return res.status(400).send(error.details[0].message);

  const userId = req.query.id;
  const sql = 'SELECT * FROM users WHERE id = ?';
  connection.query(sql, [userId], (error, results) => {
    if (error) throw error;
    res.send(results);
  });
});

const { Sequelize, DataTypes } = require('sequelize');
const sequelize = new Sequelize('sqlite::memory:');

const User = sequelize.define('User', {
  username: DataTypes.STRING,
  email: DataTypes.STRING
});

app.get('/user', async (req, res) => {
  const userId = req.query.id;
  const user = await User.findByPk(userId);
  res.send(user);
});