我使用 ? 值的占位符。
这将防止使用字符串特殊字符，例如 * 及 ; . 我怎样才能修好它？

let queryString = req.query && req.query.q;

let search = "";
let conditions = [];

if (queryString) {
    conditions = queryString.split(" ").map((condition) => {
        search += `and searchBy like ? `;
        return `%${condition}%`;
    );
}

let recordsQuery = `
            select
                r.*,
                concat(u.firstName, ' ', u.lastName) createdByUser,
                e.uid entityUid,
                searchBy
            from record r
                left join entity e on e.id = r.entityId
                left join user u on u.id = createdByUserId
            where 
                e.uid = ? 
                ${search}
            order by 
                lastUpdated desc
            ${search ? "" : "limit 1000"}
            ;
        `;

let records = await req.asyncQuery(recordsQuery, [entityUid, ...conditions]);

对于给定的查询字符串 http://example.com/api/data?q=; ，决赛 where 这个子句最后看起来像这样

where 
    e.uid = ?
    and searchBy like ?

条件数组如下所示，该值在 ? 占位符

[ '%;%' ]

这导致了 ER_PARSE_ERROR .