codesentri
bot left a review just now
+ const query = `SELECT * FROM ${table} WHERE name = '${userInput}'`;
CRITICAL
SQL Injection vulnerability
User input is interpolated directly into the SQL query string. An attacker can inject arbitrary SQL. Use parameterized queries instead.
+ for (let i = 0; i <= users.length; i++) {
WARNING
Off-by-one error in loop bound
Using <= with array.length will access an index beyond the array, causing undefined behavior. Use < instead.
+ const data = response.json();
SUGGESTION
Missing await on async method
response.json() returns a Promise. Add await to get the resolved value.