Weird error in Node.js while inserting data into SQL Server database

Question

I'm trying to inset a data into a SQL Server database using the following command:-

CREATE TABLE table_simupush
(
    id int NOT NULL IDENTITY(1,1) PRIMARY KEY,
    priority int NOT NULL
)

I can inset data by following code while test it locally:-

function SendSimupushData(data)
{
    SQL.open(connectionString, function(err, conn) {
        if(err) {
            // error handler code
            console.log("Azure database connection opening erro: "+err);
            RESPONSE.send(200, { ResponseMessage: 'error' });
        }
        else
        {
                            // it works locally 
            //var command ="INSERT INTO [dbo].[table_simupush] VALUES ('"+data+"')";
            // it also works locally
                              var command ="insert into [dbo].[table_simupush] values ("+data+")";
            console.log("connectionString open ok");
            InsertInDatabase(command, conn);
        }
    });
}

function InsertInDatabase(command, conn)
{
    SQL.query(connectionString, command, function(err, recordset) {
        if(err){
            console.log("erro: "+err);
            conn.close();
            RESPONSE.send(200, { ResponseMessage: 'error' });
            return;
        }
        else
        {
            console.log("InsertInDatabase successlly inserted");
            conn.close();
            RESPONSE.send(200, { ResponseMessage: 'ok' });
            return;
        }
   });
} 

While try the same code from Azure Mobile Service API as follows I got error:

// service bus
process.env.AZURE_SERVICEBUS_NAMESPACE= "my_namespce";
// service bus fifthelement access key
process.env.AZURE_SERVICEBUS_ACCESS_KEY= "xxxxxxxxxxxxxxxxxxxxxxx";
// azure sql database module
var SQL = require("msnodesql");
// Solax_db database conneciton string
var connectionString = "Driver={SQL Server Native Client 10.0};Server=tcp:kqgh8bqx1z.database.windows.net,1433;Database=solax_db;Uid=masum@kqgh8bqx1z;Pwd={xxxxxx};Encrypt=yes;Connection Timeout=30;";
var REQUEST;
var RESPONSE;

exports.post = function (req, res)
{
    REQUEST = req;
    RESPONSE = res;
    var data = req.RequestMessage;
    SendSimupushData(data);
}

function SendSimupushData(data)
{
    SQL.open(connectionString, function(err, conn) {
        if(err) {
            // error handler code
            console.log("Azure database connection opening erro: "+err);
            RESPONSE.send(200, { ResponseMessage: 'error' });
        }
        else
        {
            //var command ="INSERT INTO [dbo].[table_simupush] VALUES ('"+data+"')";
            var command ="insert into [dbo].[table_simupush] values ("+data+")";
            console.log("connectionString open ok");
            InsertInDatabase(command, conn);
        }
    });
}

function InsertInDatabase(command, conn)
{
    SQL.query(connectionString, command, function(err, recordset) {
        if(err){
            console.log("erro: "+err);
            conn.close();
            RESPONSE.send(200, { ResponseMessage: 'error' });
            return;
        }
        else
        {
            console.log("InsertInDatabase successlly inserted");
            conn.close();
            RESPONSE.send(200, { ResponseMessage: 'ok' });
            return;
        }
   });
}   

Error message:

Error: [Microsoft][SQL Server Native Client 10.0][SQL Server]Invalid column name 'undefined'.

Could you please let me know how should I insert data correctly from Azure to SQL Server database?

Answer 1

You are getting that error because the value in the data variable is undefined. Your query will end up looking like this:

insert into [dbo].[table_simupush] values (undefined)

As the identifier undefined is unknown, you get the error message that there is no such column name.

As it's an integer value, you should parse the input, that will also protect you from SQL injection attacks:

var data = parseInt(req.RequestMessage, 10);

With your current data that will end up as a parse error, as the value is undefined. I don't know why the object would have a property named RequestMessage , as that is not how properties are generally named, but you need to figure out where the data is that you are looking for.