Using variables in a node.js mysql-node query

Question

I am running a mysql query with WHERE, I would like to include my input prompt variable, input how would I go about doing so? my current query is like so,

var connect = connection.query('SELECT url FROM Sonic_url WHERE name='   
 + input //<where I'm confused
, function(err, rows, fields) {

baao · Accepted Answer · 2016-02-07 17:05:08Z

6

You can just include it the way you did, but that will give you an unescaped query which is open to sql - injection. To prevent you from this, you can use mysql.format

var sql = mysql.format("SELECT url FROM Sonic_url WHERE name=?", [input]);
var connection = connection.query(sql, function(err,rows,fields) {});

answered Feb 7, 2016 at 17:05

baao

73.5k18 gold badges152 silver badges209 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

alex tix Over a year ago

Thank you! also, any good method of hiding mysql logins in a script?

baao Over a year ago

node env for example, though I like dotenv. You can use an .env file with your credentials then. @alextix

alex tix Over a year ago

Thank you very much, I will try that.

Collectives™ on Stack Overflow

Using variables in a node.js mysql-node query

1 Answer 1

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Related