Using Javascript variables in MYSQL queries

Question

I've been working on this problem for a while and can't seem to find any good info on it.

I'm running a node.js server on an EC2 instance and need to add rows to a MYSQL table with the following code:

client.query('SELECT curattend FROM table1 WHERE ind=1', function(err,result){
        att = result[0].curattend;
        console.log(att);

        client.query("INSERT INTO archive (attendance) VALUES ('att')", function(err,info){
                });

        console.log(att);

        });

I printed 'att' before and after just to be sure...att is equal to '233'. However, the number'0' keeps getting uploaded into the MYSQL table.

Can anyone point me to a resource that can help me solve this?

mcriecken · Accepted Answer · 2013-07-25 22:24:46Z

3

Based on user2246674's constructive comments, I also learned something today.

Rather than this:

client.query("INSERT INTO archive (attendance) VALUES (" + att + ")"

Try this instead:

 var att  = result[0].curattend;
 client.query("INSERT INTO archive (attendance) VALUES (?);", [att], function(err,info){ });
 // This creates the insert statement INSERT INTO archive (attendance) VALUES (att);

edited Jul 25, 2013 at 22:24

answered Jul 25, 2013 at 22:03

mcriecken

3,2972 gold badges23 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user2246674 Over a year ago

Oh, yay, a whole new era of SQL injection (or accidental breakage) - surely there must be a better way? Because, the last thing I want is more of this junk.

user2246674 Over a year ago

Oh, yes. This has been solved years ago, and thankfully, it's also appears solved in node.js. (It may use escaping vs proper prepared statements, but the thing is: you shouldn't have to worry about passing data to SQL!)

Undo · Accepted Answer · 2016-05-23 21:07:22Z

0

Your code should be:

('"+att+"')"

edited May 23, 2016 at 21:07

Undo♦

25.7k38 gold badges113 silver badges132 bronze badges

answered Jul 25, 2013 at 22:03

gezzuzz

1882 silver badges16 bronze badges

1 Comment

Sergio Over a year ago

Can you explain your answer better please?

Collectives™ on Stack Overflow

Using Javascript variables in MYSQL queries

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related