node.js的乏味模块是否具有防止sql注入的功能？

Question

For your information, I'm working on preventing sql injection using Microsoft Azure & tedious module.

I saw a function called "escape" on mysql module, but I'm not sure if the similar function is in tedious module or not.

Answer 1

Escaping is an ancient technique that's annoying to use and also error prone (it's somewhat easy to forget a variable or escape it twice—and it's not uncommon to see the wrong escaping function being used). Any decent database library written in the last decade must support prepared statements or be dropped.

The side menu of the Tedious site features a prominent Using Parameters first level entry that covers this:

here is support for parameterised statements, and using parameters when calling procedures.

Input parameters are added to a Request using Request.addParameter() , and output parameters are added using Request.addOutputParameter() Parameter names

In T-SQL, parameter names are identified by being prefixed with an '@'.

 select id from address where first_name = @name and age > @age 

The parameters names used in this API do not include the '@'.

 request.addParameter('name', ..., ...); request.addParameter('age', ..., ...); 

They could have provided a less verbose syntax but it should get the job done.