> For the complete documentation index, see [llms.txt](https://geolytix.gitbook.io/xyz-developer-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://geolytix.gitbook.io/xyz-developer-guide/infrastructure/security/sql-injections.md).

# SQL Injections

All queries to the PostgreSQL database are parsed through the node-postgres module. [Queries](https://node-postgres.com/features/queries) use a battle-tested parameter substitution code.

Parameter are also checked against the workspace which is loaded into the backend process memory. Requests with parameter not found in the workspace result in a [406](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/406) response.