D1 Gotchas & Troubleshooting

Common Errors

"SQL Injection Vulnerability"

Cause: Using string interpolation instead of prepared statements with bind()
Solution: ALWAYS use prepared statements: env.DB.prepare('SELECT * FROM users WHERE id = ?').bind(userId).all() instead of string interpolation which allows attackers to inject malicious SQL

"no such table"

Cause: Table doesn't exist because migrations haven't been run, or using wrong database binding