admin管理员组

文章数量:1322504

I am running a mysql query with WHERE, I would like to include my input prompt variable, input how would I go about doing so? my current query is like so,

var connect = connection.query('SELECT url FROM Sonic_url WHERE name='   
 + input //<where I'm confused
, function(err, rows, fields) {

I am running a mysql query with WHERE, I would like to include my input prompt variable, input how would I go about doing so? my current query is like so,

var connect = connection.query('SELECT url FROM Sonic_url WHERE name='   
 + input //<where I'm confused
, function(err, rows, fields) {
Share Improve this question asked Feb 7, 2016 at 16:52 alex tixalex tix 1652 silver badges7 bronze badges
Add a ment  | 

1 Answer 1

Reset to default 6

You can just include it the way you did, but that will give you an unescaped query which is open to sql - injection. To prevent you from this, you can use mysql.format

var sql = mysql.format("SELECT url FROM Sonic_url WHERE name=?", [input]);
var connection = connection.query(sql, function(err,rows,fields) {});

本文标签: javascriptUsing variables in a nodejs mysqlnode queryStack Overflow