From a88fa9ab71adfcfb0d439c8eddd1fdc11877716f Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Tue, 29 Apr 2025 21:46:59 +0000
Subject: [PATCH] fix(security): autofix Potential SQL injection via
 string-based query concatenation - KAN-481

---
 server/routes/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/routes/index.js b/server/routes/index.js
index d6f1379..ee45fb1 100644
--- a/server/routes/index.js
+++ b/server/routes/index.js
@@ -44,7 +44,7 @@ router.get('/populate', (req, res, next) => {
 
 router.post('/search', async (req, res, next) => {
   const query = req.body.query
-  db.query(`SELECT id, name, price FROM products WHERE name LIKE '%${query}%'`)
+  db.query('SELECT id, name, price FROM products WHERE name LIKE :search', { replacements: { search: `%${query}%` } })
   .then(response => res.send(response[0]))
   .catch(error => console.log(error))
 })