From c521f691698442103372a3af0c5bd19549ee98c6 Mon Sep 17 00:00:00 2001
From: jacekey-sonar <jace.key@sonarsource.com>
Date: Tue, 30 Sep 2025 16:01:37 -0500
Subject: [PATCH] Create sql-inject.js

---
 sql-inject.js | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 sql-inject.js

diff --git a/sql-inject.js b/sql-inject.js
new file mode 100644
index 00000000000..2fa5fa1808a
--- /dev/null
+++ b/sql-inject.js
@@ -0,0 +1,23 @@
+app.post('/login', (req, res) => {
+
+  const { username, password } = req.body;
+
+  const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
+
+  connection.query(query, (err, results) => {
+
+    if (err) throw err;
+
+    if (results.length > 0) {
+
+      res.json({ success: true, user: results[0] });
+
+    } else {
+
+      res.status(401).json({ success: false, message: 'Invalid credentials' });
+
+    }
+
+  });
+
+});