Mysql query quote syntax error NodeJS

Question

I have a value: something's. Value also can be a's'a etc. Sometimes value is something | a and so on. It works fine. Trying to insert it in mysql:

mysqlConnection.query('INSERT INTO `something` (`users`,`other`) VALUES (\'' + value + '\',\'' + other + '\')'

It returns syntax error. How can I insert that value with ' symbol in mysql.query?

Ibraim Ganiev · Accepted Answer · 2015-09-27 19:06:13Z

1

Concatenating query with values is really bad idea, basically you need just to escape your values properly, but for better security you should look for example on this node-mysql lib with prepared statements, and read something about SQL Injections.

Also related: Preventing SQL injection in Node.js

edited Sep 27, 2015 at 19:06

answered Sep 27, 2015 at 19:04

Ibraim Ganiev

9,4803 gold badges36 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Arnas A. Over a year ago

That value is not from user, so there is no difference.

Ibraim Ganiev Over a year ago

@ArnasA. Ok, if you know set of such possible characters - just escape it with a backslash like described here. Or if you don't know set of possible characters - use node-mysql for this

Arnas A. Over a year ago

Can you explain more? Is this right? mysqlConnection.query('INSERT INTO something (users,other) VALUES (\'' + mysqlConnection.escape(value) + '\',\'' + other + '\')'

Ibraim Ganiev Over a year ago

mysqlConnection.query("INSERT INTO tableName (users, other) VALUES (" + value + "," + other + ")") But values by themselves must be escaped, e.g. each occurrence of ' symbol inside values should be transformed to \', you may write additional function for this, or use it from another special lib.

Collectives™ on Stack Overflow

Mysql query quote syntax error NodeJS

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related