PREPARED STATEMENTS? PREPARED TO BE VULNERABLE

Summary from the TLDR InfoSec newsletter

Prepared statements are a standard recommendation to solve most SQL injection issues. This post demonstrates a technique discovered while working on a pentest for manipulating prepared statements in JavaScript applications using the mysql or mysql2 package. The packages convert arrays and JSON objects to SQL fragments by default, which could allow an attacker to perform SQL injection.