好吧,我对这一切都很陌生,所以如果没有发现“明显”的问题,我很抱歉。我试图使用postman发布数据,但我不断得到这个错误。有人知道问题出在哪里吗?
{
"error": {
"code": "ER_PARSE_ERROR",
"errno": 1064,
"sqlMessage": "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'itemData.GPU\", \"itemData.storage\", \"itemData.size\", \"itemData.price\")' at line 1",
"sqlState": "42000",
"index": 0,
"sql": "INSERT INTO orderdetails (userID, title, device, type, CPU, RAM, GPU, storage, size, price) VALUES (\"itemdata.userID\", \"itemData.title\", \"itemData.device\", \"itemData.type\", \"itemData.CPU\", \"itemData.RAM, \"itemData.GPU\", \"itemData.storage\", \"itemData.size\", \"itemData.price\");"
}
}
我试图发布的数据:
{
"userID":1,
"title":"Nitro 5 Spin Laptop | NP515-51 | Black",
"device":"laptop",
"type":"Convertible",
"CPU":"i5-8250U",
"RAM":"8 GB",
"GPU":"GTX 1050",
"storage":"SSD",
"size":"256 GB",
"price":1099
}
.
module.exports.add = function(conData, itemData, callback){
db.connect(conData, function(err, conn){
if (err) {
callback(err);
return;
}
conn.query("INSERT INTO orderdetails (userID, title, device, type, CPU, RAM, GPU, storage, size, price) VALUES (\"itemdata.userID\", \"itemData.title\", \"itemData.device\", \"itemData.type\", \"itemData.CPU\", \"itemData.RAM, \"itemData.GPU\", \"itemData.storage\", \"itemData.size\", \"itemData.price\");", itemData, function(err,result){
callback(err, result);
});
});
1条答案
按热度按时间rmbxnbpk1#
你不能引用
itemData
作为中mysql语句中字符串的一部分conn.query()
. 你需要串联起来做VALUES (" + itemData.userID + ",
对于所有的itemData
该行上的值。我还建议研究参数化,以保护应用程序不受sql注入的影响。下面是一个简单的示例:如何在nodejs中将参数传递给mysql查询回调