温馨提示×

nodejs如何防止sql注入

小新
1006
2021-01-06 16:53:52
栏目: 云计算
前端开发者测试专用服务器限时活动,0元免费领,库存有限,领完即止! 点击查看>>

nodejs如何防止sql注入

nodejs防止sql注入的方法:

1.使用escape()对传入参数进行编码,例如:

var userId = 1, name = 'test';

var query = connection.query('SELECT * FROM users WHERE id = ' + connection.escape(userId) + ', name = ' + connection.escape(name), function(err, results) {

// ...

});

console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = 'test'

2.使用connection.query()的查询参数占位符,例如:

var userId = 1, name = 'test';

var query = connection.query('SELECT * FROM users WHERE id = ?, name = ?', [userId, name], function(err, results) {

// ...

});

console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = 'test'

3.使用escapeId()编码SQL查询标识符,例如:

sorter = 'date';

var sql = 'SELECT * FROM posts ORDER BY ' + connection.escapeId(sorter);

connection.query(sql, function(err, results) {

// ...

});

4.使用mysql.format()转义参数,例如:

userId = 1;

var sql = "SELECT * FROM ?? WHERE ?? = ?";

var inserts = ['users', 'id', userId];

sql = mysql.format(sql, inserts); // SELECT * FROM users WHERE id = 1

亿速云「云服务器」,即开即用、新一代英特尔至强铂金CPU、三副本存储NVMe SSD云盘,价格低至29元/月。点击查看>>

推荐阅读:动态sql如何防止sql注入

0