[英]I want to add single quotes in the below code ('')
let name=Response.name;
//suppose in name i am getting name=Manav //假设在名称中我得到 name=Manav
now what i need to do is现在我需要做的是
con.query("Select * from accounts_master where name="(name)
i want Manav as 'Manav' in the above line ie Select * from accounts_master where name='Manav'我希望 Manav 在上面的行中作为“Manav”,即 Select * from accounts_master where name='Manav'
Please help for the same请帮忙
Please use prepared statements instead of simple string concatenation or templates:请使用准备好的语句而不是简单的字符串连接或模板:
con.query('SELECT * FROM accounts_master WHERE name = ?', [name], (err, rows) => {
console.log(rows);
})
Doing otherwise may leave you vulnerable to SQL injection attack, as Bobby Tables demonstrates.正如Bobby Tables所展示的,否则可能会使您容易受到 SQL 注入攻击。
Here is how you can achieve it, you can use variables inside a string if the string is defined with back-tics by wrapping them inside a ${VARABLE_NAME}
这是实现它的方法,如果字符串是用 back-tics 定义的,则可以在字符串中使用变量,方法是将它们包装在
${VARABLE_NAME}
con.query(`Select * from accounts_master where name="${name}"`)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.