Sequelize: escape string in a literal string

Question

I can use literal in Sequelize to manually build a SQL query part:

sequelize.literal(`"foo".bar ILIKE '%baz%'`)

But if I want to add a var in this literal block, I now introduce SQL injection vulnerability:

sequelize.literal(`"foo".name ILIKE '%${myVar}%'`)

Is there a Sequelize way to protect variables in literal blocks?

user_978690 · Answer

You could use escape:

const escapedSearch = sequelize.escape(`%${myVar}%`);
sequelize.literal(`"foo".name ILIKE ${escapedSearch}`);

user_2585842 · Answer

You may use replacements and ? to avoid sql injections:

sequelize.query(`"foo".name ILIKE '%?%'`,
  { replacements: [myVar], type: sequelize.QueryTypes.SELECT }
)

user_2773184 · Answer

try

description = {
    $like: sequelize.literal(`${myVar} ESCAPE '\'`)
};