简体   繁体   English

我想在下面的代码中添加单引号('')

[英]I want to add single quotes in the below code ('')

let name=Response.name; 

//suppose in name i am getting name=Manav //假设在名称中我得到 name=Manav

now what i need to do is现在我需要做的是

con.query("Select * from accounts_master where name="(name)

i want Manav as 'Manav' in the above line ie Select * from accounts_master where name='Manav'我希望 Manav 在上面的行中作为“Manav”,即 Select * from accounts_master where name='Manav'

Please help for the same请帮忙

Please use prepared statements instead of simple string concatenation or templates:请使用准备好的语句而不是简单的字符串连接或模板:

con.query('SELECT * FROM accounts_master WHERE name = ?', [name], (err, rows) => {
  console.log(rows);
})

Doing otherwise may leave you vulnerable to SQL injection attack, as Bobby Tables demonstrates.正如Bobby Tables所展示的,否则可能会使您容易受到 SQL 注入攻击。

Here is how you can achieve it, you can use variables inside a string if the string is defined with back-tics by wrapping them inside a ${VARABLE_NAME}这是实现它的方法,如果字符串是用 back-tics 定义的,则可以在字符串中使用变量,方法是将它们包装在${VARABLE_NAME}

con.query(`Select * from accounts_master where name="${name}"`)

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM