How should I make a prepared statement here?

Question

I am trying to execute that query using mysql2:

const [[questions]] = 
  await db.promise().execute(
    'SELECT * FROM `questions` WHERE `questions`.`topic` LIKE ?', 
    ['%' + text + '%']
  );

but get nothing from database.

Then I tried this:

const [[questions]] = 
  await db.promise().execute(
    "SELECT * FROM `questions` WHERE `questions`.`topic` LIKE '?'",
    ['%' + text + '%']
  );

and still nothing.

How should I make prepared statement here?

I found this link useful https://stackoverflow.com/questions/57677274/transaction-for-prepared-statements-using-node-mssql — Sajana Vijayan, May 29 '20 at 19:23

score 0 · Answer 1 · answered May 29 '20 at 19:29

0

try this way :

let query = `SELECT * FROM questions WHERE questions.topic LIKE '%${text}%'`;

const data = await db.promise().execute(query);
console.log('data ==>',data);

answered May 29 '20 at 19:29

Saurabh Mistry

12,833
5
50
71

Does the library automatically prevent SQL injection when used this way? – Dave Newton May 29 '20 at 19:38

How should I make a prepared statement here?

1 Answers1