{"id":30088,"date":"2026-09-29T16:49:46","date_gmt":"2026-09-29T16:49:46","guid":{"rendered":"https:\/\/umang.pk\/2026\/09\/29\/%da%a9%d8%b3-%d8%b7%d8%b1%d8%ad-orms-%d9%be%da%be%d8%b1-%d8%a8%da%be%db%8c-sql-%d8%a7%d9%86%d8%ac%db%8c%da%a9%d8%b4%d9%86-%da%a9%db%8c-%d8%a7%d8%ac%d8%a7%d8%b2%d8%aa-%d8%af%db%8c%d8%aa%db%92-%db%81\/"},"modified":"2026-09-29T16:49:46","modified_gmt":"2026-09-29T16:49:46","slug":"%da%a9%d8%b3-%d8%b7%d8%b1%d8%ad-orms-%d9%be%da%be%d8%b1-%d8%a8%da%be%db%8c-sql-%d8%a7%d9%86%d8%ac%db%8c%da%a9%d8%b4%d9%86-%da%a9%db%8c-%d8%a7%d8%ac%d8%a7%d8%b2%d8%aa-%d8%af%db%8c%d8%aa%db%92-%db%81","status":"publish","type":"post","link":"https:\/\/umang.pk\/ur\/2026\/09\/29\/%da%a9%d8%b3-%d8%b7%d8%b1%d8%ad-orms-%d9%be%da%be%d8%b1-%d8%a8%da%be%db%8c-sql-%d8%a7%d9%86%d8%ac%db%8c%da%a9%d8%b4%d9%86-%da%a9%db%8c-%d8%a7%d8%ac%d8%a7%d8%b2%d8%aa-%d8%af%db%8c%d8%aa%db%92-%db%81\/","title":{"rendered":"\u06a9\u0633 \u0637\u0631\u062d ORMs \u067e\u06be\u0631 \u0628\u06be\u06cc SQL \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba (\u0627\u0648\u0631 \u062e\u0644\u0627 \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0628\u0646\u062f \u06a9\u0631\u06cc\u06ba)"},"content":{"rendered":"\n<div id=\"\">\n<p>\u0628\u06c1\u062a \u0633\u06d2 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u0641\u0631\u0636 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u062c\u0628 \u0648\u06c1 ORM \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648\u060c SQL \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u0627\u0628 \u06a9\u0648\u0626\u06cc \u0645\u0633\u0626\u0644\u06c1 \u0646\u06c1\u06cc\u06ba \u0631\u06c1\u062a\u0627 \u06c1\u06d2\u06d4 \u0644\u06cc\u06a9\u0646 \u06cc\u06c1 \u062f\u0648\u0631 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u06c1\u0645 \u0627\u0628\u06be\u06cc \u0645\u0646\u062a\u0642\u0644 \u06c1\u0648 \u06af\u0626\u06d2\u06d4<\/p>\n<p>ORMs \u062c\u06cc\u0633\u06d2 Sequelize\u060c Prisma\u060c TypeORM\u060c \u0627\u0648\u0631 Knex \u062e\u0648\u062f \u0628\u062e\u0648\u062f \u0628\u0644\u0679 \u0633\u0648\u0627\u0644\u0627\u062a \u06a9\u0648 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0648\u06c1 \u062d\u0635\u06c1 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u0633\u0626\u0644\u06c1 \u0648\u06c1\u0627\u06ba \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u06c1\u0627\u06ba \u0627\u06cc\u067e \u0645\u062d\u0641\u0648\u0638 \u0631\u0627\u0633\u062a\u06d2 \u0633\u06d2 \u06c1\u0679 \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u06cc\u0639\u0646\u06cc\u060c \u0627\u06cc\u06a9 \u062e\u0627\u0645 \u0633\u0648\u0627\u0644 \u062c\u0633 \u06a9\u0627 ORM \u06a9\u0627 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u0628\u0644\u0688\u0631 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u0638\u06c1\u0627\u0631 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u0633\u06a9\u062a\u0627\u060c \u0627\u06cc\u06a9 \u0645\u062a\u062d\u0631\u06a9 \u062a\u0631\u062a\u06cc\u0628 \u0648\u0627\u0644\u0627 \u06a9\u0627\u0644\u0645\u060c \u06cc\u0627 \u0648\u0627\u062d\u062f \u0645\u062f\u062f\u06af\u0627\u0631 \u0641\u0646\u06a9\u0634\u0646 \u062c\u0633 \u062a\u06a9 \u0622\u067e \u0628\u063a\u06cc\u0631 \u0633\u0648\u0686\u06d2 \u0633\u0645\u062c\u06be\u06d2 \u067e\u06c1\u0646\u0686 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u06cc\u06c1 \u067e\u06c1\u0644\u06cc \u062c\u06af\u06c1 \u06c1\u06d2 \u062c\u06c1\u0627\u06ba \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u0646\u0638\u0631 \u0622\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633 \u0633\u06d2 \u0645\u062d\u0631\u0648\u0645 \u06c1\u0648\u0646\u0627 \u0622\u0633\u0627\u0646 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0648\u06c1 \u0645\u062d\u0633\u0648\u0633 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0628\u0627\u0642\u06cc \u06a9\u0648\u0688 \u0628\u06cc\u0633 \u0645\u062d\u0641\u0648\u0638 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1\u0627\u06ba \u06c1\u0645 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u0686\u0627\u0631 \u0646\u0645\u0648\u0646\u0648\u06ba \u067e\u0631 \u062a\u0648\u062c\u06c1 \u0645\u0631\u06a9\u0648\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06c1\u0631 \u0627\u06cc\u06a9 \u06a9\u0648 \u0627\u06cc\u06a9 \u062d\u0642\u06cc\u0642\u06cc \u062f\u0646\u06cc\u0627 \u06a9\u06cc \u0645\u062b\u0627\u0644 \u0645\u0644\u062a\u06cc \u06c1\u06d2 \u062c\u0648 \u0628\u06af \u06a9\u0627 \u0633\u0628\u0628 \u0628\u0646\u062a\u06cc \u06c1\u06d2\u060c \u0627\u0633 \u0628\u0627\u062a \u06a9\u0627 \u062a\u062c\u0632\u06cc\u06c1 \u06a9\u06c1 \u0628\u06af \u06a9\u06cc\u0648\u06ba \u0641\u0627\u0626\u062f\u06c1 \u0645\u0646\u062f \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0644\u06a9\u06be\u0627 \u06c1\u0648\u0627 \u0648\u0631\u0698\u0646 \u062c\u0648 \u0627\u0633\u06d2 \u0628\u0646\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633 \u0645\u06cc\u06ba \u06cc\u06c1 \u0646\u0648\u0679 \u0628\u06be\u06cc \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0628\u0627\u0644\u06a9\u0644 \u06a9\u06cc\u0627 \u0645\u0646\u062a\u0642\u0644 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u0627\u0648\u0631 \u06a9\u06cc\u0648\u06ba\u06d4<\/p>\n<p>\u0622\u067e \u06a9\u0648 \u067e\u06cc\u0631\u0648\u06cc \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0633\u06cc \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u067e\u0633 \u0645\u0646\u0638\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06a9\u0648\u0688 \u06a9\u0648 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0622\u067e \u06a9\u0648 \u0635\u0631\u0641 Node.js\u060c SQL\u060c \u0627\u0648\u0631 \u06a9\u0645 \u0627\u0632 \u06a9\u0645 \u0627\u06cc\u06a9 ORM \u0633\u06d2 \u06a9\u0627\u0641\u06cc \u062d\u062f \u062a\u06a9 \u0648\u0627\u0642\u0641 \u06c1\u0648\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-prerequisites\">\u0634\u0631\u0637\u06cc\u06ba<\/h2>\n<p>\u0645\u062b\u0627\u0644\u0648\u06ba \u0633\u06d2 \u0627\u0646\u062f\u0627\u0632\u06c1 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u062f\u0631\u062c \u0630\u06cc\u0644 \u0633\u06d2 \u0648\u0627\u0642\u0641 \u06c1\u06cc\u06ba:<\/p>\n<ul>\n<li>\n<p>Node.js \u0627\u0648\u0631 \u0627\u06cc\u06a9\u0633\u067e\u0631\u06cc\u0633 \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f\u06cc \u0628\u0627\u062a\u06cc\u06ba<\/p>\n<\/li>\n<li>\n<p>\u0628\u0646\u06cc\u0627\u062f\u06cc SQL \u0633\u0648\u0627\u0644\u0627\u062a \u0644\u06a9\u06be\u0646\u0627<\/p>\n<\/li>\n<li>\n<p>ORM \u06a9\u0627 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0627\u0633\u062a\u0639\u0645\u0627\u0644 (\u062a\u0645\u0627\u0645 \u06a9\u0648\u0688 \u06a9\u06cc \u0645\u062b\u0627\u0644\u06cc\u06ba Sequelize \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0644\u06cc\u06a9\u0646 \u067e\u06cc\u0679\u0631\u0646 Prisma\u060c TypeORM\u060c Knex \u0648\u063a\u06cc\u0631\u06c1 \u067e\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u0627 \u06c1\u06d2)<\/p>\n<\/li>\n<li>\n<p>HTTP \u062f\u0631\u062e\u0648\u0627\u0633\u062a\/\u0631\u0633\u067e\u0627\u0646\u0633 \u0633\u0627\u0626\u06cc\u06a9\u0644 \u06a9\u06cc\u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ul>\n<p><strong>\u06a9\u0648\u0688 \u06a9\u06cc \u0645\u062b\u0627\u0644\u0648\u06ba \u067e\u0631 \u0646\u0648\u0679\u0633<\/strong>: \u0627\u0633 \u06af\u0627\u0626\u06cc\u0688 \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 <code>sequelize<\/code> \u0641\u0631\u0636 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0634\u0631\u0648\u0639 \u06a9\u0631\u062f\u06c1 \u0633\u06cc\u06a9\u0648\u06cc\u0644\u0627\u0626\u0632 \u0645\u062b\u0627\u0644 \u06c1\u06d2\u06d4 <code>QueryTypes<\/code> \u0627\u0648\u0631 <code>Op<\/code> \u0633\u06d2 \u062f\u0631\u0622\u0645\u062f <code>'sequelize'<\/code> \u0627\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be\u060c \u0627\u0648\u0631 <code>User<\/code>\/<code>Product<\/code> \u0627\u06cc\u067e \u0645\u06cc\u06ba \u06a9\u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0628\u06cc\u0627\u0646 \u06a9\u0631\u062f\u06c1 \u0627\u06cc\u06a9 \u0633\u06cc\u06a9\u0648\u0626\u0644\u0627\u0626\u0632 \u0645\u0627\u0688\u0644\u06d4 \u0686\u0648\u0646\u06a9\u06c1 \u06cc\u06c1\u0627\u06ba \u062d\u0648\u0627\u0644\u06c1 \u062f\u06cc\u0627 \u06af\u06cc\u0627 \u06a9\u0686\u06be APIs \u0628\u0691\u06d2 \u0648\u0631\u0698\u0646 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0628\u062f\u0644 \u06af\u0626\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u0645\u062b\u0627\u0644\u06cc\u06ba Sequelize v6+ \u0646\u062d\u0648 (\u0645\u0648\u062c\u0648\u062f\u06c1 \u0627\u06c1\u0645 \u0648\u0631\u0698\u0646) \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u0622\u067e \u0627\u067e\u0646\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062f\u06c1 \u0648\u0631\u0698\u0646 \u0627\u0648\u0631 ORM \u06a9\u06d2 \u0645\u0637\u0627\u0628\u0642 \u0646\u062d\u0648 \u06a9\u0648 \u0627\u06cc\u0688\u062c\u0633\u0679 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-table-of-contents\">\u0627\u0646\u0688\u06cc\u06a9\u0633<\/h2>\n<h2 id=\"heading-1-raw-query-escape-hatches\">1. \u062e\u0627\u0645 \u0633\u0648\u0627\u0644 \u0641\u0631\u0627\u0631 \u06c1\u06cc\u0686<\/h2>\n<p>\u062a\u0645\u0627\u0645 \u0628\u0691\u06d2 ORMs \u0627\u0646 \u0633\u0648\u0627\u0644\u0627\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 &quot;Escape hatches&#8221; \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0646 \u06a9\u0627 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u0627 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u0638\u06c1\u0627\u0631 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u0627\u06d4 <code>sequelize.query()<\/code>\u067e\u0631\u06cc\u0632\u0645\u0627 \u06a9\u0627 <code>$queryRawUnsafe<\/code>\u06cc\u0627 TypeORM <code>query()<\/code>. \u06cc\u06c1 \u0627\u0686\u06be\u06cc \u0648\u062c\u0648\u06c1\u0627\u062a \u06a9\u06cc \u0628\u0646\u0627 \u067e\u0631 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u060c \u062c\u06cc\u0633\u06d2 \u067e\u06cc\u0686\u06cc\u062f\u06c1 \u062c\u0648\u0627\u0626\u0646\u0632\u060c \u0648\u0646\u0688\u0648 \u0641\u0646\u06a9\u0634\u0646\u0632\u060c \u0627\u0648\u0631 \u0648\u06cc\u0646\u0688\u0631 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u062e\u0635\u0648\u0635 SQL\u06d4<\/p>\n<p>\u0645\u0633\u0626\u0644\u06c1 \u0627\u0633 \u0648\u0642\u062a \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u0688\u06cc\u0648\u0644\u067e\u0631\u0632 \u0641\u0631\u0627\u0631 \u06c1\u0648\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u06c1\u06cc\u0686\u0632 \u06a9\u0648 \u0628\u0627\u0642\u06cc ORM \u06a9\u06cc \u0637\u0631\u062d \u0679\u0631\u06cc\u0679 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0635\u0627\u0631\u0641 \u06a9\u0627 \u0627\u0646 \u067e\u0679 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0628\u0644\u0679 \u0633\u0679\u0631\u0646\u06af \u0645\u06cc\u06ba \u062f\u0627\u062e\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0639\u0627\u0645 \u0641\u0644\u0679\u0631 \u0634\u062f\u06c1 \u0631\u067e\u0648\u0631\u0679 \u06a9\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u06a9\u0627\u062a \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.get('\/reports', async (req, res) => {\n  const { region } = req.query;\n  const results = await sequelize.query(\n    `SELECT * FROM sales WHERE region = '${region}'`,\n    { type: QueryTypes.SELECT }\n  );\n  res.json(results);\n});\n<\/code><\/pre>\n<p>\u0622\u067e \u06a9\u0648 \u06cc\u06c1 \u0633\u0679\u0631\u0646\u06af \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u0628\u0644\u0688\u0631 \u0645\u06cc\u06ba \u0646\u0638\u0631 \u0646\u06c1\u06cc\u06ba \u0622\u0626\u06d2 \u06af\u06cc\u06d4 \u06cc\u06c1 \u0628\u0627\u0644\u06a9\u0644 \u0627\u0633\u06cc \u0637\u0631\u062d \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0688\u0631\u0627\u0626\u06cc\u0648\u0631 \u06a9\u0648 \u0628\u06be\u06cc\u062c \u062f\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h4 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h4>\n<p>\u0627\u0633 \u0637\u0631\u062d \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a: <code>?region=' OR '1'='1<\/code> \u0627\u067e\u0646\u06d2 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0648 \u0627\u0633 \u0633\u06d2 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u06cc\u06ba: <code>SELECT * FROM sales WHERE region = '' OR '1'='1'<\/code>\u06cc\u06c1 \u06c1\u0645\u06cc\u0634\u06c1 \u0633\u0686 \u06c1\u06d2\u06d4 \u0679\u06cc\u0628\u0644 \u0645\u06cc\u06ba \u062a\u0645\u0627\u0645 \u0642\u0637\u0627\u0631\u06cc\u06ba \u062f\u0648\u0628\u0627\u0631\u06c1 \u0646\u0645\u0648\u062f\u0627\u0631 \u06c1\u0648\u06ba \u06af\u06cc\u060c \u0642\u0637\u0639 \u0646\u0638\u0631 \u062e\u0637\u06d2 \u06a9\u06d2\u06d4<\/p>\n<p>\u0627\u0633 \u0633\u06d2 \u0628\u06be\u06cc \u0628\u062f\u062a\u0631\u060c \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u06a9\u0648\u0688 ORM \u067e\u0631 \u0645\u0628\u0646\u06cc \u067e\u0631\u0648\u062c\u06cc\u06a9\u0679 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0631\u06c1\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u0627\u0633\u06d2 \u0627\u06a9\u062b\u0631 \u0648\u06cc\u0633\u06cc \u062c\u0627\u0646\u0686 \u0646\u06c1\u06cc\u06ba \u0645\u0644\u062a\u06cc \u062c\u062a\u0646\u06cc \u0645\u0642\u0627\u0645\u06cc \u0637\u0648\u0631 \u067e\u0631 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 <code>mysql.query()<\/code> \u06a9\u0627\u0644 \u06a9\u0648\u0688\u0628\u06cc\u0633 \u0633\u06d2 \u06a9\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u060c ORM \u0633\u06d2 \u0646\u06c1\u06cc\u06ba\u06d4 \u062c\u0627\u0626\u0632\u06c1 \u0644\u06cc\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0641\u0631\u0636 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 ORM \u0646\u06d2 \u067e\u06c1\u0644\u06d2 \u06c1\u06cc \u0627\u0633 \u06a9\u0627 \u062e\u06cc\u0627\u0644 \u0631\u06a9\u06be\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u0633\u0679\u0631\u0646\u06af \u06a9\u0648 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0644\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2\u060c \u0622\u067e \u0642\u06cc\u0645\u062a \u06a9\u0648 \u0645\u062a\u0628\u0627\u062f\u0644\/\u0628\u0627\u0626\u0646\u0688\u0646\u06af \u0645\u06cc\u06a9\u0627\u0646\u0632\u0645 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0645\u0646\u062a\u0642\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u06a9\u06c1 \u062e\u0627\u0645 \u0633\u0648\u0627\u0644 API \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.get('\/reports', async (req, res) => {\n  const { region } = req.query;\n  const results = await sequelize.query(\n    'SELECT * FROM sales WHERE region = :region',\n    {\n      replacements: { region },\n      type: QueryTypes.SELECT\n    }\n  );\n  res.json(results);\n});\n<\/code><\/pre>\n<p>\u062e\u0627\u0645 \u0633\u0648\u0627\u0644\u0627\u062a \u0633\u06d2 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u06af\u0631\u06cc\u0632 \u06a9\u0631\u0646\u0627 \u062f\u0631\u0633\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u060c \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0628\u0639\u0636 \u0627\u0648\u0642\u0627\u062a \u062e\u0627\u0645 \u0633\u0648\u0627\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0636\u0631\u0648\u0631\u06cc \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062c\u0628 \u0628\u0627\u0626\u0646\u0688\u0646\u06af \u0645\u06cc\u06a9\u0627\u0646\u0632\u0645 \u0648\u06c1\u0627\u06ba \u0645\u0648\u062c\u0648\u062f \u06c1\u0648 \u062a\u0648 \u0622\u067e \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0627\u06cc\u0633 \u06a9\u06cc\u0648 \u0627\u06cc\u0644 \u0633\u0679\u0631\u0646\u06af\u0632 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0627\u0646 \u067e\u0679 \u06a9\u0648 \u062e\u0627\u0645 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06d2 \u0627\u0633\u0679\u0631\u0646\u06af \u0645\u06cc\u06ba \u0645\u062a \u062c\u0648\u0691\u06cc\u06ba\u06d4 \u062e\u0627\u0645 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06d2 \u0637\u0631\u06cc\u0642\u0648\u06ba \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062f\u06c1 \u0641\u0627\u0644 \u0628\u06cc\u06a9\/\u0628\u0627\u0626\u0646\u0688\u0646\u06af APIs \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/strong><\/p>\n<h2 id=\"heading-2-identifiers-that-cant-be-parameterized\">2. \u063a\u06cc\u0631 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u0627\u06cc\u0628\u0644 \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646<\/h2>\n<p>\u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632\u0688 \u0633\u0648\u0627\u0644\u0627\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062a\u062d\u0641\u0638 <em>\u0642\u062f\u0631<\/em>. \u0648\u06c1 \u062d\u0641\u0627\u0638\u062a \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06d2 <em>\u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06c1<\/em> \u0679\u06cc\u0628\u0644 \u06a9\u0627 \u0646\u0627\u0645\u060c \u06a9\u0627\u0644\u0645 \u06a9\u0627 \u0646\u0627\u0645\u060c \u06cc\u0627 <code>ORDER BY<\/code> \u0633\u0645\u062a \u06cc\u06c1 \u062e\u0648\u062f SQL \u0633\u0679\u0631\u0646\u06af \u06a9\u0627 \u062d\u0635\u06c1 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1\u06cc \u0648\u062c\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0688\u0627\u0626\u0646\u0627\u0645\u06a9 \u0686\u06be\u0627\u0646\u0679\u0646\u06d2 \u06a9\u06d2 \u0641\u0646\u06a9\u0634\u0646\u0632 \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 \u062c\u06af\u06c1\u0648\u06ba \u0645\u06cc\u06ba \u0633\u06d2 \u0627\u06cc\u06a9 \u06c1\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u0627\u0686\u06be\u06cc \u0637\u0631\u062d \u0633\u06d2 \u0644\u06a9\u06be\u06d2 \u06c1\u0648\u0626\u06d2 ORM \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u062f\u0627\u062e\u0644 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0627\u06cc\u06a9 \u0639\u0627\u0645 \u062a\u0631\u062a\u06cc\u0628 \u062f\u06cc\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0641\u06c1\u0631\u0633\u062a \u06a9\u0627 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u06cc\u06c1 \u06c1\u0648\u06af\u0627:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.get('\/users', async (req, res) => {\n  const { sortBy = 'created_at' } = req.query;\n  const users = await sequelize.query(\n    `SELECT * FROM users ORDER BY ${sortBy}`,\n    { type: QueryTypes.SELECT }\n  );\n  res.json(users);\n});\n<\/code><\/pre>\n<p><code>sortBy<\/code>    \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06d2 \u062a\u0627\u0631 \u0633\u06d2 <code>ORDER BY<\/code> \u0622\u06cc\u0627\u062a \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h4 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h4>\n<p><code>sortBy<\/code>    \u06cc\u06c1 \u0627\u06cc\u06a9 \u0628\u06d2 \u0636\u0631\u0631 UI \u0633\u06c1\u0648\u0644\u062a \u06a9\u06cc \u0637\u0631\u062d \u0644\u06af\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u06a9\u0648\u0626\u06cc \u0627\u0633\u06d2 \u0645\u062c\u06be\u06d2 \u0646\u06c1 \u0628\u06be\u06cc\u062c\u06d2\u06d4 <code>created_at; DROP TABLE users; --<\/code>. \u0622\u06cc\u0627 \u0635\u062d\u06cc\u062d \u067e\u06d2 \u0644\u0648\u0688 \u06a9\u0648 \u0639\u0645\u0644 \u0645\u06cc\u06ba \u0644\u0627\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2 \u0627\u0633 \u06a9\u0627 \u0627\u0646\u062d\u0635\u0627\u0631 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0688\u0631\u0627\u0626\u06cc\u0648\u0631 \u067e\u0631 \u06c1\u06d2\u06d4 \u067e\u0648\u0633\u0679\u06af\u0631\u06cc\u0633 \u06a9\u0627 <code>pg<\/code> \u0688\u0631\u0627\u0626\u06cc\u0648\u0631 \u0627\u0633 \u0637\u0631\u062d \u06a9\u06d2 \u0627\u0633\u0679\u06cc\u06a9 \u0627\u0633\u0679\u06cc\u0679\u0645\u0646\u0679 \u06a9\u0648 \u0628\u0637\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0627\u0646\u062c\u0627\u0645 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0628\u06a9\u06c1 MySQL \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 <code>mysql2<\/code> \u0627\u0633\u06d2 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u06cc\u06ba \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u0622\u067e \u0627\u06cc\u0633\u0627 \u0646\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4 <code>multipleStatements: true<\/code> \u06cc\u06c1 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0645\u0642\u0631\u0631 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2.<\/p>\n<p>\u0628\u06c1\u0631 \u062d\u0627\u0644\u060c \u0628\u0646\u06cc\u0627\u062f\u06cc \u0645\u0633\u0626\u0644\u06c1 \u0627\u06cc\u06a9 \u06c1\u06cc \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u0627\u06cc\u0633\u06cc \u062c\u06af\u06c1 \u067e\u0631 \u0635\u0648\u0627\u0628\u062f\u06cc\u062f\u06cc SQL \u06c1\u06d2 \u062c\u0633 \u06a9\u0627 \u0645\u0642\u0635\u062f \u0635\u0631\u0641 \u06a9\u0627\u0644\u0645 \u06a9\u06d2 \u0646\u0627\u0645 \u0631\u06a9\u06be\u0646\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646 \u06a9\u0648 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0632 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u067e\u0627\u0628\u0646\u062f \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u060c \u0644\u06c1\u0630\u0627 \u0648\u0627\u062d\u062f \u0645\u062d\u0641\u0648\u0638 \u0622\u067e\u0634\u0646 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\nconst ALLOWED_SORT_COLUMNS = ['created_at', 'name', 'email'];\n\napp.get('\/users', async (req, res) => {\n  const { sortBy = 'created_at' } = req.query;\n  const column = ALLOWED_SORT_COLUMNS.includes(sortBy) ? sortBy : 'created_at';\n\n  const users = await sequelize.query(\n    `SELECT * FROM users ORDER BY ${column}`,\n    { type: QueryTypes.SELECT }\n  );\n  res.json(users);\n});\n<\/code><\/pre>\n<p>\u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0627\u0646 \u067e\u0679 \u06a9\u0648 \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06c1 \u06a9\u06d2 \u0645\u0642\u0627\u0645 \u062a\u06a9 \u0646\u06c1 \u067e\u06c1\u0646\u0686\u0627\u0626\u06cc\u06ba\u060c \u06cc\u06c1\u0627\u06ba \u062a\u06a9 \u06a9\u06c1 \u067e\u06c1\u0644\u06d2 \u0627\u0633\u06d2 &quot;\u0635\u0627\u0641 \u0635\u0627\u0641&#8221; \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0628\u0639\u062f\u06d4 \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646 \u067e\u0631 \u062d\u0630\u0641 \u06a9\u0631\u0646\u0627 \u0627\u0642\u062f\u0627\u0631 \u06a9\u0648 \u062d\u0630\u0641 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0645\u0642\u0627\u0628\u0644\u06d2 \u0645\u06cc\u06ba \u063a\u0644\u0637 \u06c1\u0648\u0646\u0627 \u0628\u06c1\u062a \u0622\u0633\u0627\u0646 \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646 \u06a9\u0648 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u06d4 \u0627\u06af\u0631 \u06a9\u0633\u06cc \u06a9\u0627\u0644\u0645 \u06cc\u0627 \u0679\u06cc\u0628\u0644 \u06a9\u06d2 \u0646\u0627\u0645 \u06a9\u0627 \u062a\u0639\u06cc\u0646 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0627\u0646 \u067e\u0679 \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f \u067e\u0631 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0627\u0633\u06d2 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u0627\u0633\u06d2 \u062d\u0630\u0641 \u0646\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4<\/strong><\/p>\n<h2 id=\"heading-3-second-order-injection-through-stored-data\">3. \u0630\u062e\u06cc\u0631\u06c1 \u0634\u062f\u06c1 \u0688\u06cc\u0679\u0627 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0633\u06cc\u06a9\u0646\u0688\u0631\u06cc \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646<\/h2>\n<p>\u06cc\u06c1 \u0679\u06cc\u0645 \u06a9\u0648 \u0686\u0648\u06a9\u0633 \u06a9\u0631 \u062f\u06cc\u062a\u06cc \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0627\u0646 \u06a9\u06d2 \u067e\u0627\u0633 \u0627\u0646 \u067e\u0679 \u06c1\u06d2\u06d4 <em>\u062a\u06be\u0627<\/em> \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632\u0688&#8230;\u067e\u06c1\u0644\u06d2 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0645\u06cc\u06ba \u0631\u06cc\u06a9\u0627\u0631\u0688 \u06a9\u06cc\u0627 \u06af\u06cc\u0627\u06d4<\/p>\n<p>\u0627\u0646\u062c\u06a9\u0634\u0646 \u0628\u0639\u062f \u0645\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0630\u062e\u06cc\u0631\u06c1 \u0634\u062f\u06c1 \u0642\u062f\u0631\u0648\u06ba \u06a9\u0648 \u06a9\u0633\u06cc \u0627\u0648\u0631 \u063a\u06cc\u0631 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632\u0688 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u0645\u06cc\u06ba \u062f\u0648\u0628\u0627\u0631\u06c1 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0630\u06cc\u0644 \u0645\u06cc\u06ba \u0631\u062c\u0633\u0679\u0631\u06cc\u0634\u0646 \u06a9\u0627 \u0628\u06c1\u0627\u0624 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u06a9\u0648\u0688 \u0628\u06cc\u0633 \u0645\u06cc\u06ba \u06a9\u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0627\u06cc\u0688\u0645\u0646 \u0633\u0631\u0686 \u0641\u0646\u06a9\u0634\u0646 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\n\n\/\/ Step 1: user registration, correctly parameterized\napp.post('\/register', async (req, res) => {\n  await User.create({ username: req.body.username });\n  res.json({ success: true });\n});\n\n\/\/ Step 2: somewhere else in the codebase, an admin search feature\napp.get('\/admin\/search', async (req, res) => {\n  const user = await User.findByPk(req.params.id);\n  const results = await sequelize.query(\n    `SELECT * FROM audit_log WHERE actor=\"${user.username}\"`,\n    { type: QueryTypes.SELECT }\n  );\n  res.json(results);\n});\n<\/code><\/pre>\n<p>\u0645\u0631\u062d\u0644\u06c1 1 \u062e\u0648\u062f \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u0645\u062d\u0641\u0648\u0638 \u06c1\u06d2\u06d4 \u0645\u0631\u062d\u0644\u06c1 2 \u0648\u06c1 \u062c\u06af\u06c1 \u06c1\u06d2 \u062c\u06c1\u0627\u06ba \u0645\u0633\u0626\u0644\u06c1 \u067e\u06cc\u062f\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h4 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h4>\n<p>\u0635\u0627\u0631\u0641 \u06a9\u0627 \u0646\u0627\u0645 \u062f\u0631\u062c \u0630\u06cc\u0644 \u06c1\u06d2\u06d4 <code>admin' OR '1'='1<\/code> \u0628\u063a\u06cc\u0631 \u06a9\u0633\u06cc \u067e\u0631\u06cc\u0634\u0627\u0646\u06cc \u06a9\u06d2 \u0645\u0631\u062d\u0644\u06c1 1 \u067e\u0627\u0633 \u06a9\u0631\u06cc\u06ba\u06d4 Sequelize \u06a9\u06cc <code>create()<\/code> \u0622\u067e \u0627\u0633\u06d2 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0644\u06c1\u0630\u0627 \u06cc\u06c1 \u0628\u0627\u0644\u06a9\u0644 \u0627\u0633\u06cc \u0637\u0631\u062d \u0645\u062d\u0641\u0648\u0638 \u06c1\u0648\u062c\u0627\u062a\u0627 \u06c1\u06d2 \u062c\u06cc\u0633\u06d2 \u0622\u067e \u0646\u06d2 \u0627\u0633\u06d2 \u062f\u0631\u062c \u06a9\u06cc\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0645\u06cc\u06ba \u06c1\u06d2 \u062c\u0648 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u0639\u0627\u0645 \u0644\u06af\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u067e\u06d2 \u0644\u0648\u0688 \u0635\u0631\u0641 \u0627\u0646 \u0627\u0642\u062f\u0627\u0631 \u06a9\u0648 \u0645\u0631\u062d\u0644\u06c1 2 \u0633\u06d2 \u0648\u0627\u067e\u0633 \u062d\u0627\u0635\u0644 \u06a9\u0631\u06a9\u06d2 \u0627\u0648\u0631 \u0627\u0646\u06c1\u06cc\u06ba \u062e\u0627\u0645 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06d2 \u0633\u0679\u0631\u0646\u06af \u0645\u06cc\u06ba \u0688\u0627\u0644 \u06a9\u0631 \u06c1\u06cc \u0639\u0645\u0644 \u0645\u06cc\u06ba \u0644\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 &quot;\u06cc\u06c1 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u06c1\u06cc \u06c1\u0645\u0627\u0631\u06d2 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0645\u06cc\u06ba \u06c1\u06d2&#8221; \u0648\u06c1\u06cc \u0686\u06cc\u0632 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u062c\u06cc\u0633\u06d2 &quot;\u06cc\u06c1 \u0645\u062d\u0641\u0648\u0638 \u06c1\u06d2\u06d4&#8221; \u0627\u06af\u0631 \u06cc\u06c1 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0627\u0646 \u067e\u0679 \u0633\u06d2 \u06a9\u06c1\u06cc\u06ba \u0628\u06be\u06cc \u0627\u0648\u067e\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u0627\u0628 \u0628\u06be\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 \u0645\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u067e\u06cc\u0679\u0631\u0646 #1 \u06a9\u06d2 \u0628\u0631\u0627\u0628\u0631 \u06c1\u0648\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062a\u0631\u0645\u06cc\u0645 \u06a9\u06cc \u06af\u0626\u06cc\u06d4 \u0627\u0642\u062f\u0627\u0631 \u06a9\u0648 \u062c\u0648\u0691\u0646\u06d2 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u0646 \u06a9\u0648 \u062c\u0648\u0691\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\n\n\/\/ Step 1 (registration) is unchanged \u2014 it was already parameterized\n\napp.get('\/admin\/search', async (req, res) => {\n  const user = await User.findByPk(req.params.id);\n  const results = await sequelize.query(\n    'SELECT * FROM audit_log WHERE actor = :actor',\n    {\n      replacements: { actor: user.username },\n      type: QueryTypes.SELECT\n    }\n  );\n  res.json(results);\n});\n<\/code><\/pre>\n<p>\u067e\u06cc\u0679\u0631\u0646 # 1 \u06a9\u06d2 \u0645\u0642\u0627\u0628\u0644\u06d2 \u0645\u06cc\u06ba \u06cc\u06c1\u0627\u06ba \u0628\u06af \u06a9\u0648 \u062a\u0644\u0627\u0634 \u06a9\u0631\u0646\u0627 \u0645\u0634\u06a9\u0644 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0622\u0644\u0648\u062f\u06c1 \u0688\u06cc\u0679\u0627 \u0627\u0633\u06d2 \u062e\u0637\u0631\u0646\u0627\u06a9 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u06a9\u06d2 \u0686\u06a9\u0631 \u0644\u06af\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0622\u067e \u06a9\u06d2 \u0627\u067e\u0646\u06d2 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u0688\u06cc\u0679\u0627 \u062e\u0648\u062f \u0628\u062e\u0648\u062f \u0645\u062d\u0641\u0648\u0638 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0627\u0633\u06d2 \u062c\u06c1\u0627\u06ba \u06a9\u06c1\u06cc\u06ba \u0628\u06be\u06cc \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u0633\u06d2 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u06cc\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u060c \u0686\u0627\u06c1\u06d2 \u0627\u0633 \u06a9\u06cc \u0627\u0628\u062a\u062f\u0627 \u06a9\u06c1\u06cc\u06ba \u0627\u0648\u067e\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0627\u0646 \u067e\u0679 \u0633\u06d2 \u06c1\u0648\u06d4<\/strong><\/p>\n<h2 id=\"heading-4-raw-sql-smuggled-into-normal-orm-calls\">4. \u062e\u0627\u0645 SQL \u06a9\u0648 \u062e\u0641\u06cc\u06c1 \u0637\u0648\u0631 \u067e\u0631 \u0628\u0627\u0642\u0627\u0639\u062f\u06c1 ORM \u06a9\u0627\u0644\u0648\u06ba \u0645\u06cc\u06ba \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u0644\u06af\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/h2>\n<p>\u067e\u06cc\u0679\u0631\u0646 \u0646\u0645\u0628\u0631 1 \u06c1\u06d2\u06d4 <em>\u0648\u0627\u0636\u062d<\/em> Raw query escape hatches \u062d\u0642\u06cc\u0642\u06cc SQL \u062a\u06a9 \u067e\u06c1\u0646\u0686\u0646\u06d2 \u06a9\u0627 \u0627\u06cc\u06a9 \u062c\u0627\u0646 \u0628\u0648\u062c\u06be \u06a9\u0631 \u0637\u0631\u06cc\u0642\u06c1 \u06c1\u06d2 \u062c\u0628 \u0627\u0633 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u062a\u06be\u0648\u0691\u0627 \u0632\u06cc\u0627\u062f\u06c1 \u06a9\u067e\u0679\u06cc \u06c1\u06d2. \u0627\u0646\u062c\u06a9\u0634\u0646 \u06a9\u0627\u0644\u0648\u06ba \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0686\u06be\u067e\u0627 \u06c1\u0648\u0627 \u06c1\u06d2 \u062c\u0648 \u067e\u0648\u0631\u06cc \u0637\u0631\u062d \u0633\u06d2 ORM \u06a9\u06d2 \u0632\u06cc\u0631 \u0627\u0646\u062a\u0638\u0627\u0645 \u062f\u06a9\u06be\u0627\u0626\u06cc \u062f\u06cc\u062a\u06cc \u06c1\u06d2\u06d4 \u06cc\u06c1 \u062e\u0627\u0645 SQL \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u060c \u06c1\u06d2 \u0646\u0627\u061f \u06cc\u06c1 \u0628\u06c1\u062a \u0633\u06d2 \u0645\u062f\u062f\u06af\u0627\u0631 \u0627\u0641\u0639\u0627\u0644 \u0645\u06cc\u06ba \u0633\u06d2 \u0627\u06cc\u06a9 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0630\u06cc\u0644 \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0639\u0627\u0645 \u0641\u0644\u0679\u0631 \u0634\u062f\u06c1 \u0645\u0635\u0646\u0648\u0639\u0627\u062a \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u06c1\u06d2:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.get('\/products', async (req, res) => {\n  const { minPrice } = req.query;\n  const products = await Product.findAll({\n    where: sequelize.literal(`price > ${minPrice}`)\n  });\n  res.json(products);\n});\n<\/code><\/pre>\n<p><code>Product.findAll()<\/code>    \u06cc\u06c1 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u0645\u062d\u0641\u0648\u0638\u060c \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632\u0688 ORM \u06a9\u0627\u0644 \u06a9\u06cc \u0637\u0631\u062d \u0644\u06af\u062a\u0627 \u06c1\u06d2\u06d4 <code>sequelize.literal()<\/code> \u0627\u0633 \u0645\u06cc\u06ba \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h4 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h4>\n<p><code>literal()<\/code>    Sequelize \u0633\u06d2 \u06a9\u06c1\u0648\u060c &quot;\u0627\u0633\u06d2 \u0645\u062a \u0686\u06be\u0648\u0626\u06d2\u06d4 \u0627\u0633\u06d2 \u0627\u06cc\u0633 \u06a9\u06cc\u0648 \u0627\u06cc\u0644 \u0645\u06cc\u06ba \u0628\u0627\u0644\u06a9\u0644 \u0627\u0633\u06cc \u0637\u0631\u062d \u062f\u0627\u062e\u0644 \u06a9\u0631\u06cc\u06ba\u06d4&#8221; \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0686\u06cc\u0632 \u062c\u0648 \u0627\u0646\u0679\u0631\u067e\u0648\u0644\u06cc\u0679 \u06a9\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2 \u0648\u06c1 \u0628\u0627\u0644\u06a9\u0644 \u067e\u06cc\u0679\u0631\u0646 # 1 \u06a9\u06cc \u0637\u0631\u062d \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u0628\u06be\u06cc\u0633 \u0645\u06cc\u06ba \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u0633\u0627\u062f\u06c1 \u0646\u0638\u0631 \u0622\u0646\u06d2 \u0648\u0627\u0644\u0627 ORM \u0637\u0631\u06cc\u0642\u06c1\u06d4<\/p>\n<p>\u062c\u0627\u0646\u06d2 \u062f\u0648 <code>?minPrice=0 OR 1=1<\/code> \u0627\u0648\u0631 <code>WHERE<\/code> \u0634\u0642 \u063a\u06cc\u0631 \u0645\u0634\u0631\u0648\u0637 \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u0633\u062a \u06c1\u06d2\u06d4 \u062a\u0645\u0627\u0645 \u0642\u0637\u0627\u0631\u06cc\u06ba \u062f\u0648\u0628\u0627\u0631\u06c1 \u0638\u0627\u06c1\u0631 \u06c1\u0648\u06ba \u06af\u06cc\u060c \u0642\u0637\u0639 \u0646\u0638\u0631 \u0627\u0633 \u0633\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u0642\u06cc\u0645\u062a \u06a9\u0627 \u0641\u0644\u0679\u0631 \u06c1\u06d2 \u06cc\u0627 \u0646\u06c1\u06cc\u06ba\u06d4 \u0627\u0633 \u0648\u0642\u062a \u0627\u0633\u0679\u06cc\u06a9 \u0627\u0633\u0679\u06cc\u0679\u0645\u0646\u0679 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0686\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0648\u0627\u062d\u062f \u0628\u0648\u0644\u06cc\u0646 \u0627\u0638\u06c1\u0627\u0631 \u06c1\u06d2\u060c \u06cc\u06c1 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0688\u0631\u0627\u0626\u06cc\u0648\u0631 \u0633\u06d2 \u0642\u0637\u0639 \u0646\u0638\u0631 \u0627\u06cc\u06a9 \u062c\u06cc\u0633\u0627 \u0628\u0631\u062a\u0627\u0624 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u067e\u06c1\u0646\u0686\u0646\u0627 \u0628\u0646\u062f \u06a9\u0631\u0648 <code>literal()<\/code>. Sequelize \u06a9\u0627 \u0627\u067e\u0646\u0627 \u0622\u067e\u0631\u06cc\u0679\u0631 API \u067e\u06c1\u0644\u06d2 \u06c1\u06cc \u0627\u0633 \u06a9\u06cc\u0633 \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.get('\/products', async (req, res) => {\n  const minPrice = Number(req.query.minPrice);\n\n  if (!Number.isFinite(minPrice)) {\n    return res.status(400).json({ error: 'minPrice must be a number' });\n  }\n\n  const products = await Product.findAll({\n    where: { price: { [Op.gt]: minPrice } }\n  });\n  res.json(products);\n});\n<\/code><\/pre>\n<p><code>Op.gt<\/code>\u060c <code>Op.between<\/code>\u060c <code>Op.in<\/code>Sequelize \u06a9\u0627 \u0628\u0627\u0642\u06cc \u0622\u067e\u0631\u06cc\u0679\u0631 API \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u06c1\u06cc \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0645\u0639\u0627\u0645\u0644\u0627\u062a \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0644\u0648\u06af \u067e\u06c1\u0646\u0686\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>literal()<\/code> \u06a9\u06d2 \u0644\u0626\u06d2 \u0627\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2. \u062a\u0635\u062f\u06cc\u0642 <code>minPrice<\/code> \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u067e\u0631 \u067e\u06c1\u0646\u0686\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06cc\u06c1 \u062f\u0631\u062d\u0642\u06cc\u0642\u062a \u0627\u06cc\u06a9 \u0639\u062f\u062f \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0627\u06af\u0631 \u0627\u0633\u06d2 \u0645\u0633\u062a\u0642\u0628\u0644 \u06a9\u06d2 \u0631\u06cc\u0641\u06cc\u06a9\u0679\u0631 \u0645\u06cc\u06ba \u062f\u0648\u0628\u0627\u0631\u06c1 \u0645\u062a\u0639\u0627\u0631\u0641 \u06a9\u0631\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u06cc\u06c1 \u062e\u0644\u0627 \u06a9\u0645 \u06c1\u0648 \u062c\u0627\u0626\u06d2 \u06af\u0627\u06d4 <code>literal()<\/code> \u06a9\u06c1\u06cc\u06ba \u0627\u0648\u0631\u06d4<\/p>\n<p><strong>\u067e\u06a9\u0691\u0646\u0627<\/strong> <code>literal(<\/code><strong>\u060c<\/strong> <code>fn(<\/code><strong>\u0627\u0648\u0631 ORM \u06a9\u06d2 \u062f\u06cc\u06af\u0631 \u062e\u0627\u0645 \u0641\u0631\u0627\u0631 \u06c1\u06cc\u0686\u0632 \u06c1\u0631 \u062c\u06af\u06c1 \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u0648\u06c1 \u06a9\u0648\u0688 \u0628\u06cc\u0633 \u0645\u06cc\u06ba \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0646\u06c1 \u06a9\u06c1 \u0635\u0631\u0641 \u0627\u0646\u062f\u0631 \u06a9\u06d2 \u0633\u0648\u0627\u0644\u0627\u062a \u062c\u0648 \u0638\u0627\u06c1\u0631 \u06c1\u06d2 \u06a9\u06c1 &quot;\u06a9\u0686\u06cc&#8221; \u06c1\u06cc\u06ba\u06d4<\/strong><\/p>\n<h2 id=\"heading-summary\">\u062e\u0644\u0627\u0635\u06c1<\/h2>\n<p>\u062a\u06cc\u0632\u06cc \u0633\u06d2 \u062e\u0644\u0627\u0635\u06c1 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0622\u0626\u06cc\u06d2 \u062f\u06cc\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0686\u0627\u0631 \u067e\u06cc\u0679\u0631\u0646 \u06a9\u06cc\u0633\u06d2 \u0645\u0644\u062a\u06d2 \u06c1\u06cc\u06ba:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u067e\u06cc\u0679\u0631\u0646<\/th>\n<th>\u0628\u0646\u06cc\u0627\u062f\u06cc \u0648\u062c\u06c1<\/th>\n<th>\u0628\u0646\u06cc\u0627\u062f\u06cc \u062f\u0631\u0633\u062a\u06af\u06cc<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u062e\u0627\u0645 \u0633\u0648\u0627\u0644 \u0641\u0631\u0627\u0631 \u06c1\u06cc\u0686<\/td>\n<td>\u0635\u0627\u0631\u0641 \u06a9\u0627 \u0627\u0646 \u067e\u0679 \u062e\u0627\u0645 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06d2 \u0627\u0633\u0679\u0631\u0646\u06af \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0645\u0631\u0628\u0648\u0637 \u06c1\u06d2\u06d4<\/td>\n<td>\u062a\u0628\u062f\u06cc\u0644\u06cc\/\u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631 API \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0628\u0627\u0626\u0646\u0688\u0646\u06af \u0627\u0642\u062f\u0627\u0631<\/td>\n<\/tr>\n<tr>\n<td>\u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06c1 \u0627\u0646\u062c\u06a9\u0634\u0646<\/td>\n<td>\u06a9\u0627\u0644\u0645\/\u0679\u06cc\u0628\u0644\/\u0633\u0627\u0646\u0679 \u0627\u0646 \u067e\u0679\u0633 \u06a9\u0648 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u06d4<\/td>\n<td>\u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0645\u06cc\u06ba \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646 \u06a9\u06cc \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u062f\u0648\u0633\u0631\u0627 \u0627\u0646\u062c\u06a9\u0634\u0646<\/td>\n<td>\u0630\u062e\u06cc\u0631\u06c1 \u0634\u062f\u06c1 \u0688\u06cc\u0679\u0627 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0627\u0633\u06d2 \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4<\/td>\n<td>\u062a\u0645\u0627\u0645 \u0633\u0648\u0627\u0644\u0627\u062a \u06a9\u0648 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u0631\u06cc\u06ba\u060c \u06cc\u06c1\u0627\u06ba \u062a\u06a9 \u06a9\u06c1 \u0648\u06c1 \u0628\u06be\u06cc \u062c\u0648 \u0622\u067e \u06a9\u0627 \u0627\u067e\u0646\u0627 \u0630\u062e\u06cc\u0631\u06c1 \u0634\u062f\u06c1 \u0688\u06cc\u0679\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u0644\u0641\u0638\u06cc \u0627\u0646\u062c\u06a9\u0634\u0646<\/td>\n<td>\u062e\u0627\u0645 SQL \u06a9\u0648 ORM \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u06a9\u0627\u0644\u0632 \u0645\u06cc\u06ba \u0627\u0633\u0645\u06af\u0644 \u06a9\u06cc\u0627 \u06af\u06cc\u0627\u06d4<\/td>\n<td>\u0628\u0686\u0646\u0627 <code>literal()<\/code>\/<code>raw()<\/code>\u0627\u0633 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2\u060c \u0627\u067e\u0646\u06d2 ORM \u06a9\u0627 \u0622\u067e\u0631\u06cc\u0679\u0631 API \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u0627\u0646 \u0686\u0627\u0631 \u06a9\u06cc\u0691\u0648\u06ba \u0645\u06cc\u06ba \u0633\u06d2 \u06a9\u0633\u06cc \u06a9\u0648 \u062a\u0644\u0627\u0634 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u06c1\u0646\u0631 \u0645\u0646\u062f \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u06af\u06cc\u06d4 \u06c1\u0631 \u0627\u06cc\u06a9 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u0642\u062f\u0631 \u06c1\u06d2 \u062c\u0648 ORM \u06a9\u06d2 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632\u06cc\u0634\u0646 \u067e\u0627\u062a\u06be \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u067e\u0646\u06d2 \u0648\u0631\u06a9 \u0641\u0644\u0648 \u06a9\u0627 \u062d\u0635\u06c1 \u0628\u0646\u0627\u0646\u06d2 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u0686\u06cc\u0632\u06cc\u06ba: \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u0648\u06cc\u0644\u06cc\u0648\u0632\u060c \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646\u060c \u0627\u067e\u0646\u06d2 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0633\u06d2 \u0646\u06a9\u0627\u0644\u06d2 \u06af\u0626\u06d2 \u0688\u06cc\u0679\u0627 \u06a9\u0648 \u0646\u0626\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u0633\u06d2 \u06a9\u0645 \u0645\u062d\u0641\u0648\u0638 \u0633\u0645\u062c\u06be\u06cc\u06ba\u060c <code>literal()<\/code>\/<code>raw()<\/code> \u06a9\u0627\u0644 \u0628\u0627\u0644\u06a9\u0644 \u0627\u062a\u0646\u0627 \u06c1\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u06c1\u06d2 \u062c\u062a\u0646\u0627 \u06a9\u06c1 \u0627\u06cc\u06a9 \u0648\u0642\u0641 \u0634\u062f\u06c1 \u062e\u0627\u0645 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0627 \u0637\u0631\u06cc\u0642\u06c1 (\u0686\u0627\u06c1\u06d2 \u0622\u0633 \u067e\u0627\u0633 \u06a9\u0627 \u06a9\u0648\u0688 \u06a9\u062a\u0646\u0627 \u06c1\u06cc \u0645\u062d\u0641\u0648\u0638 \u06a9\u06cc\u0648\u06ba \u0646\u06c1 \u06c1\u0648)\u06d4<\/p>\n<p>\u0627\u0646 \u062e\u0644\u0627\u0621 \u06a9\u0648 \u062f\u0648\u0631 \u06a9\u0631\u0646\u0627 \u0635\u0631\u0641 \u0622\u062f\u06be\u06cc \u062a\u0635\u0648\u06cc\u0631 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u062c\u0627\u0646\u0646\u0627 \u06a9\u06c1 \u06a9\u0648\u0626\u06cc \u0634\u062e\u0635 \u062f\u0631\u062d\u0642\u06cc\u0642\u062a \u0627\u0646 \u06a9\u06cc \u062a\u0644\u0627\u0634 \u06a9\u06cc\u0633\u06d2 \u06a9\u0631 \u0631\u06c1\u0627 \u06c1\u06d2 (\u0627\u0648\u0631 \u062d\u0642\u06cc\u0642\u06cc \u062a\u0634\u062e\u06cc\u0635 \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u0627\u0646 \u0633\u06d2 \u06a9\u06cc\u0633\u06d2 \u062c\u0691\u0646\u0627 \u06c1\u06d2) \u0648\u06c1 \u0646\u0635\u0641 \u06c1\u06d2 \u062c\u0648 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u062f\u06cc\u06a9\u06be\u062a\u06d2\u06d4<\/p>\n<p>\u0627\u06af\u0631 \u0622\u067e \u062c\u0627\u0631\u062d\u0627\u0646\u06c1 \u0646\u0642\u0637\u06c1 \u0646\u0638\u0631 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u062c\u0627\u0646\u0646\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 ORM \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0627\u06cc\u0633 \u06a9\u06cc\u0648 \u0627\u06cc\u0644 \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u0645\u06cc\u06ba \u06cc\u06c1 \u06af\u06c1\u0631\u0627 \u063a\u0648\u0637\u06c1 \u0622\u067e \u06a9\u0648 \u0627\u0633 \u0628\u0627\u062a \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0628\u062a\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u0686\u0627\u0631 \u0646\u0645\u0648\u0646\u06d2 \u062d\u0642\u06cc\u0642\u06cc \u0648\u0642\u062a \u0645\u06cc\u06ba \u062f\u062e\u0648\u0644 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u0645\u06cc\u06ba \u06a9\u0633 \u0637\u0631\u062d \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u06d2 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u0628\u06c1\u062a \u0633\u06d2 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u0641\u0631\u0636 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u062c\u0628 \u0648\u06c1 ORM \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648\u060c SQL \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u0627\u0628 \u06a9\u0648\u0626\u06cc \u0645\u0633\u0626\u0644\u06c1 \u0646\u06c1\u06cc\u06ba \u0631\u06c1\u062a\u0627 \u06c1\u06d2\u06d4 \u0644\u06cc\u06a9\u0646 \u06cc\u06c1 \u062f\u0648\u0631 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u06c1\u0645 \u0627\u0628\u06be\u06cc \u0645\u0646\u062a\u0642\u0644 \u06c1\u0648 \u06af\u0626\u06d2\u06d4 ORMs \u062c\u06cc\u0633\u06d2 Sequelize\u060c Prisma\u060c TypeORM\u060c \u0627\u0648\u0631 Knex \u062e\u0648\u062f \u0628\u062e\u0648\u062f \u0628\u0644\u0679 \u0633\u0648\u0627\u0644\u0627\u062a \u06a9\u0648 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0648\u06c1 \u062d\u0635\u06c1 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-30088","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/30088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/comments?post=30088"}],"version-history":[{"count":0,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/30088\/revisions"}],"wp:attachment":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/media?parent=30088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/categories?post=30088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/tags?post=30088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}