nodejs防止sql注入的方法:使用escape()对传入参数进行编码,例如:var userId = 1, name = 'test';var query = connection.query('SELECT * FROM us
使用escape()对传入参数进行编码,例如:
var userId = 1, name = 'test';
var query = connection.query('SELECT * FROM users WHERE id = ' + connection.escape(userId) + ', name = ' + connection.escape(name), function(err, results) {
// ...
});
console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = 'test'
使用connection.query()的查询参数占位符,例如:
var userId = 1, name = 'test';
var query = connection.query('SELECT * FROM users WHERE id = ?, name = ?', [userId, name], function(err, results) {
// ...
});
console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = 'test'
使用escapeId()编码SQL查询标识符,例如:
sorter = 'date';
var sql = 'SELECT * FROM posts ORDER BY ' + connection.escapeId(sorter);
connection.query(sql, function(err, results) {
// ...
});
userId = 1;
var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts); // SELECT * FROM users WHERE id = 1
--结束END--
本文标题: nodejs如何防止sql注入
本文链接: https://www.lsjlt.com/news/115550.html(转载时请注明来源链接)
有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341
下载Word文档到电脑,方便收藏和打印~
2024-05-02
2024-05-02
2024-05-02
2024-05-02
2024-05-02
2024-05-02
2024-05-02
2024-05-02
2024-05-02
2024-05-02
回答
回答
回答
回答
回答
回答
回答
回答
回答
回答
0