如何避免 SQL 查询中的硬编码

Question

I have a query like Select '16453842' AS ACCOUNT, I want to change this Account number to a dynamic one. Can anyone tell me what are some possible ways to do it? The scenario is like, I would also like to accommodate other values as well for the ACCOUNT. So that multiple values can be used for ACCOUNT.

the Nodejs code uses that sql in below code by carrierData.sql

writeDebug({'shipment': shipment, 'carrier': carrier, 'message': 'reading sql file: ' + carrierData.sql});
  fs.readFile(carrierData.sql, 'utf8', function (err, sql) {

The carrierData is coming from a json file from where the sql contains the path and name of the SQL which it is going to use. And finally the SQL file which have the query runs a query like below SELECT 'T' AS RECORD , '16453842' AS ACCOUNT

and here lies my problem as we have some additional ACCOUNT numbers as well which we would like to accommodate. And the service starts by node server.js which will call the workers.js file which contains the code that I pasted above. So please let me know what can be the possible ways to do this

Answer 1

Here are things to research:

1. Using bind variables . These are used for security and for performance when a statement is executed multiple times.

2. Using multiple values in IN clauses .

3. Using executeMany() if you are loading data into the database.