@@ src/api/users.ts @@
export async function getUser(req) {
-  return db.query("SELECT * FROM users " +
-    "WHERE id = " + req.params.id);
+  return db.query(
+    "SELECT * FROM users WHERE id = $1",
+    [req.params.id]);
}
 
# agent: security-strict
✓ OWASP A03 · injection corrigée
 
export function listRepos(user) {
-  const repos = fetchAll();
+  const repos = fetchAll(user.id);
  return repos.filter(r => r.active);
}