如何将JavaScript字符串隐藏为node.js中的可执行代码

Question

I have saved query in database. I can get query as a string.

INSERT INTO alertsV SET Instance_ID = ${body.add.Instance_ID}

But ${body.add.Instance_ID} is not replacing with value.

expected result should be INSERT INTO alertsV SET Instance_ID = 1234

I am using nodejs. Please help me how to fix this. Here is the function.

  saveFormData: async function (req, res) {
     let form_id = parseInt(req.body.form_id);
     let body = req.body.form_data;
     let saveQuery = await sails.orientDb.command('select actions.save as 
     saveQuery from form where form_id=' + form_id).one();

     saveQuery = saveQuery.saveQuery; // i can get string here 'INSERT INTO alertsV SET Instance_ID = ${body.add.Instance_ID}'
     let result = await sails.orientDb.command(saveQuery).one();
     return res.json(result);
  }

Answer 1

You can wrap a string in the template literal backticks and pass it to eval to run string interpolation:

saveQuery = eval('`' + saveQuery.saveQuery + '`'); 

 const a = 10; const str = 'test ${a} test'; console.log(eval('`' + str + '`')); /* if it's required to wrap the interpolated value into a quotes, you can do that by wrapping the embedded expression, prior to interpolation: */ console.log(eval('`' + str.replace(/(\\${.*})/, '\\'$1\\'') + '`'));