Is database security ensured when using input data sanitization to prevent SQL injections?

Input data escaping is one way to reduce the risk of SQL injection, but it does not guarantee complete database security. It is better to use parameterized queries (prepared statements), which separate SQL code from data, reliably preventing malicious code injection.

For example, in Node.js using the mysql2 library:

const mysql = require('mysql2/promise');

async function getUserById(userId) {
  const connection = await mysql.createConnection({ /* connection parameters */ });
  const [rows] = await connection.execute('SELECT * FROM users WHERE id = ?', [userId]);
  return rows;
}

Thus, escaping can help, but it is always better to use parameterized queries and ORM, which automatically protect against SQL injection.