can not send mysql query

Question

I have a problem to send a mysql query where this problem :ER_PARSE_ERROR: You have an error in your SQL syntax appears, my code where user is an javascript object contains 3 strings username,email,password .

let sql2 = 'insert into users (username,email,password) values (' + user.username + ',' + user.email + ',' + user.password + ')'  //query

           
        db.query(sql2,(err,result) => {
                if(err) throw err 
                res.send('User registriation done')
        })

you need to use escaping arround every injected variable. use db.escape() for exemple. — Raphael PICCOLO
– Raphael PICCOLO, Commented Aug 23, 2021 at 21:26
@Barmar if i need to use this query how to write user.emailcorrect : let sql = "select email from users where email = " + user.email — amro3
– amro3, Commented Aug 23, 2021 at 22:00
let sql = 'select email from users where email = ?' and then pass user.email in the parameter arraay. — Barmar
– Barmar, Commented Aug 23, 2021 at 22:02

Barmar · Accepted Answer · 2021-08-23 21:29:08Z

2

You're not putting quotes around the string values. But the correct way is to use parameters rather than concatenating variables into the SQL.

let sql2 = 'insert into users (username,email,password) values (?, ?, ?)' //query
db.query(sql2, [user.username, user.email, user.password], (err, result) => {
  if (err) throw err
  res.send('User registriation done')
})

answered Aug 23, 2021 at 21:29

Barmar

789k57 gold badges555 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

can not send mysql query

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related