From 712d8b5addf0c7733f04562004eebea4613c63e8 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 12:17:24 +0000
Subject: [PATCH] fix(security): autofix Potential SQL injection via
 string-based query concatenation

---
 server/routes/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/routes/index.js b/server/routes/index.js
index d6f1379..c39d6c4 100644
--- a/server/routes/index.js
+++ b/server/routes/index.js
@@ -44,7 +44,7 @@ router.get('/populate', (req, res, next) => {
 
 router.post('/search', async (req, res, next) => {
   const query = req.body.query
-  db.query(`SELECT id, name, price FROM products WHERE name LIKE '%${query}%'`)
+  db.query(`SELECT id, name, price FROM products WHERE name LIKE ?`, [`%${query}%`])
   .then(response => res.send(response[0]))
   .catch(error => console.log(error))
 })