sql 更新声明 node.js

Question

我在 sql 中的更新语句有问题，我不确定这是否可行，但我正在尝试这个：

var updateStudent = "update table set CHILDNAME2 = '" + req.body.childName + "', REPORT2 = '" + report + "', YEAR2 = '" + req.body.year + "', STARTDAY2 = '" + req.body.startDay + "', STARTTIME2 = '" + req.body.startTime + "', ENDTIME2 = '" + req.body.endTime + "', ENDDAY2 = '" + req.body.endDay + "', MONTH2 = '" + req.body.month + "' WHERE USERNAME = '" + req.body.username + "')"

它给了我错误：

 [Error: [IBM][CLI Driver][DB2/LINUXX8664] SQL0104N  An unexpected token ")" was found following "ERNAME = 'undefined'".  Expected tokens may include:  "END-OF-STATEMENT".  SQLSTATE=42601
] {
  error: '[node-ibm_db] SQL_ERROR',
  sqlcode: -104,
  state: '42601'
}

我不知道如何解决这个问题。 谢谢你的帮助:)

Answer 1

我可以建议您使用参数化查询来使您的查询不那么混乱。 实际使用起来也更安全。

var updateStudent = `UPDATE table
SET CHILDNAME2 = ?,
REPORT2 = ? YEAR2 = ?,
STARTDAY2 = ?,
REPORT2 = ?,
YEAR2 = ?,
STARTTIME2 = ?,
ENDTIME2 = ?,
MONTH2 = ?
WHERE USERNAME = ?`;

let variables = [
    req.body.childName,
    report,
    req.body.year
    ...
];

con.query(updateStudent, variables, (err, fields, response) => {
    ...
});

let variables = [
    req.body.childName,
    report,
    req.body.year
    ...
];

con.query(updateStudent, variables), (err, fields, response) => {
    ...
});