Using variables in a node.js mysql-node query

Question

I am running a mysql query with WHERE, I would like to include my input prompt variable, input how would I go about doing so? my current query is like so,

var connect = connection.query('SELECT url FROM Sonic_url WHERE name='   
 + input //<where I'm confused
, function(err, rows, fields) {

Answer 1

You can just include it the way you did, but that will give you an unescaped query which is open to sql - injection. To prevent you from this, you can use mysql.format

var sql = mysql.format("SELECT url FROM Sonic_url WHERE name=?", [input]);
var connection = connection.query(sql, function(err,rows,fields) {});