Are Prisma queries parameterized to prevent SQL injections?

[sinful umbra]

I was just reading about parameterized queries today and I was wondering does Prisma use parameterized queries under the hood to prevent SQL injections?

I tried searching the docs for info about this, but could only find info about writing raw queries that are parameterized (which is not what I am trying to do)

[orchid pond]

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

[blazing prairie]

Yes, if you turn logging on you can see the queries, it takes a touch more effort to see the parameter values, but it's doable.

[orchid pond]

Thank you for marking this question as solved!

Learn more

https://answeroverflow.com

[sinful umbra]

thanks!

[blazing prairie]

const { PrismaClient } = require('@prisma/client');

const { config } = require('../../config');

const db = new PrismaClient({ log: config.prisma.log }); // .$extends(withOptimize());

// This will only fire when log has 'query' sent to it
// so no need to disable in dev/prod
db.$on('query', (e) => {
  /* eslint-disable no-console */
  console.log(`Params: ${e.params}`);
  /* eslint-enable no-console */
});

module.exports = {
  db,
};

This is my local env config

const devConfig = require('./development');

module.exports = {
    ...devConfig,
    prisma: {
        log: [
            'query',
            'info',
            'warn',
            'error',
        ]
    }
};