Escape single quote in Postgres query inside node js app

Question

Here is a line from my node js code:

var qry = 'INSERT INTO "sma"."RMD"("UserId","Favourite")  VALUES (' + req.body.user + ',' + JSON.stringify(req.body.favourite) + ')'

I want to insert single quotes before JSON.stringify(req.body.favourite). But i'm unable to escape the single quotes. I can't debug the issue since I'm uploading the code to a predix cloud server Any idea how to achieve that?

For the love of.... USE PARAMETERIZED QUERIES!!!!!!!!!!!!!! Don't ever write code where you assemble the query like you do in your question. You are vulnerable to SQL-INJECTION-ATTACS. — some
– some, Commented Jan 19, 2017 at 13:59
You should never do it! Let the database library escape the values correctly as part of the query formatting. — vitaly-t
– vitaly-t, Commented Jan 19, 2017 at 14:06
The question is legit there are situations where one might need it e.g getting time interval '1 DAY' — amar
– amar, Commented Oct 7, 2019 at 15:26

e4c5 · Accepted Answer · 2017-01-19 13:36:17Z

8

Why don't you use prepared statements?

var qry = 'INSERT INTO "sma"."RMD"("UserId","Favourite")  VALUES ($1, $2)';
client.query(qry, [ req.body.user, JSON.stringify(req.body.favourite])'

answered Jan 19, 2017 at 13:36

e4c5

53.9k11 gold badges110 silver badges139 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:01:35Z

3

You could also use template literals to build your query

Template literals which use the back-tick character Check main answer here

alert(`Use "double" and 'single' quotes in the same string`);
alert(`The escape the \` back-tick character in a string`);

Template literals offer a clean syntax for: variable interpolation, multi-line strings, and more.

edited May 23, 2017 at 12:01

CommunityBot

11 silver badge

answered Jan 19, 2017 at 13:43

Rocha

311 bronze badge

1 Comment

amar Over a year ago

This should be the accepted answer to the question asked. Though OP is doing it wrong by string formatting the query still there are cases when you need to escape quotes within query e.g using time interval '1 Day'

Collectives™ on Stack Overflow

Escape single quote in Postgres query inside node js app

2 Answers 2

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related