Spot the Injection

Three queries, one hole. Every value the user controls goes through a placeholder… except one. The flag is the name of the query-string parameter that reaches the database unparameterised, in the form ctfbox{<parameter>}.

app.get("/api/products", async (req, res) => {
  const { q = "", category = "all", sort = "name", page = "1" } = req.query;
  const limit = 20;
  const offset = (Number(page) - 1) * limit;
  const rows = await db.query(
    `SELECT id, name, price FROM products
     WHERE name ILIKE $1 AND ($2 = 'all' OR category = $2)
     ORDER BY ${sort} LIMIT $3 OFFSET $4`,
    [`%${q}%`, category, limit, offset]
  );
  res.json(rows);
});