sql update statement node.js

Question

I am having a problem with my update statement in sql, I am not sure if this is possible, but I am trying this:

var updateStudent = "update table set CHILDNAME2 = '" + req.body.childName + "', REPORT2 = '" + report + "', YEAR2 = '" + req.body.year + "', STARTDAY2 = '" + req.body.startDay + "', STARTTIME2 = '" + req.body.startTime + "', ENDTIME2 = '" + req.body.endTime + "', ENDDAY2 = '" + req.body.endDay + "', MONTH2 = '" + req.body.month + "' WHERE USERNAME = '" + req.body.username + "')"

it is giving me the error:

 [Error: [IBM][CLI Driver][DB2/LINUXX8664] SQL0104N  An unexpected token ")" was found following "ERNAME = 'undefined'".  Expected tokens may include:  "END-OF-STATEMENT".  SQLSTATE=42601
] {
  error: '[node-ibm_db] SQL_ERROR',
  sqlcode: -104,
  state: '42601'
}

I'm not sure how to fix this. thx for ur help:)

Answer 1

I can suggest you to use parameterized queries to make your query less confusing. Also it's safer to use actually.

var updateStudent = `UPDATE table
SET CHILDNAME2 = ?,
REPORT2 = ? YEAR2 = ?,
STARTDAY2 = ?,
REPORT2 = ?,
YEAR2 = ?,
STARTTIME2 = ?,
ENDTIME2 = ?,
MONTH2 = ?
WHERE USERNAME = ?`;

let variables = [
    req.body.childName,
    report,
    req.body.year
    ...
];

con.query(updateStudent, variables, (err, fields, response) => {
    ...
});

let variables = [
    req.body.childName,
    report,
    req.body.year
    ...
];

con.query(updateStudent, variables), (err, fields, response) => {
    ...
});