0

I'm using node.js and having the following error when inserting a record to DB:

\node_modules\mysql\lib\protocol\Parser.js:437
      throw err; // Rethrow non-MySQL errors
      ^
OkPacket {
  fieldCount: 0,
  affectedRows: 1,
  insertId: 9,
  serverStatus: 2,
  warningCount: 0,
  message: '',
  protocol41: true,
  changedRows: 0
}

while executing the following code

createCard: function( card, card_type, card_url, callback){
    connection.query('INSERT INTO cards (card, card_type, url)' +
    ' VALUES ("'+ card+'", "'+card_type+'", "'+card_url+'")', function(done,err,rows,fields){
        if (err) throw err;
        callback(rows.insertId); // returns the id of the card just created
    })
  },

The record gets inserted in my DB, but the server stops with the error above. Before this I did not have the "done" argument and was having "done is not defined" error.

MrWater
  • 1,797
  • 4
  • 20
  • 47
  • your code should use prepared statements with parameters. – nbk Jun 11 '20 at 21:51
  • Hi @nbk What do you mean by using prepared statements with parameters? You are requesting me to write parameters' values like card, card_type, card_url , is that it ? – MrWater Jun 13 '20 at 13:57
  • take alook at this post and read about sql injection https://stackoverflow.com/questions/15778572/preventing-sql-injection-in-node-js – nbk Jun 13 '20 at 16:17

0 Answers0