0

Heey all, I have a quick question concerning simple/double quotes in javascript, using NodeJS and MySQL database.. here's my code

app.get('/AddCollection', function (req, res) {
  var queryData = url.parse(req.url , true).query;
    connection.query("INSERT IGNORE INTO collections VALUES ('" +queryData.nom+ "' ,'"  +queryData.categorie+ "','" +queryData.description+ "','" + queryData.urlimage+"')", function (err, result) {
            if (err) throw err;
            res.json("Vous avez ajouté "+queryData.categorie+"et"+queryData.description+"et"+queryData.objet+"a la table");
        }
    );
});
<script src="https://cdnjs.cloudflare.com/ajax/libs/react/15.1.0/react.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/react/15.1.0/react-dom.min.js"></script>

delete query :

app.get('/DeleteCollection', function (req, res) {
  var queryData = url.parse(req.url , true).query;
    connection.query("DELETE FROM `collections` WHERE `collections`.`nom` ='"+queryData.nom+"'", function (err, result) {
            if (err) throw err;
            res.json("Vous avez ajouté supprimé la collection"+ queryData.nom);
        }
    );
});

Thing is that I already used simple and double quotes for the call. So for example, if queryData.nom or queryData.categorie is equal to the heroes' places then the code won't work as it will confuse the simple quotes.. How do I fix that?

Mich
  • 182
  • 3
  • 6
  • 21
  • Possible duplicate of [Node sql syntax error](https://stackoverflow.com/questions/47442567/node-sql-syntax-error) – Brahma Dev Mar 25 '18 at 20:17
  • 1
    Possible duplicate of [Single quote escape in JavaScript function parameters](https://stackoverflow.com/questions/8744315/single-quote-escape-in-javascript-function-parameters) – Aᴍɪʀ Mar 25 '18 at 20:20
  • yeah I've read these threads but didn't manage to make it work =/ – Mich Mar 25 '18 at 20:37

1 Answers1

1

Parameterize your query

connection.query("INSERT IGNORE INTO collections VALUES (?, ?, ?, ?)", [queryData.nom, queryData.categorie, queryData.description, queryData.urlimage], function (err, result) {
        if (err) throw err;
        res.json("Vous avez ajouté "+queryData.categorie+"et"+queryData.description+"et"+queryData.objet+"a la table");
    }
);
Ronin
  • 26
  • 1
  • thanks loads man! do you know how I would do that with a delete query? i've Updated the answer and added the delete one, i've searched a bit but it seems so weird.. – Mich Mar 27 '18 at 18:30
  • connection.query("DELETE FROM `collections` WHERE `collections`.`nom` = ?", [queryData.nom], function (err, result) { if (err) throw err; res.json("Vous avez ajouté supprimé la collection"+ queryData.nom); } ); – Ronin Mar 29 '18 at 05:03