Skip to content Skip to sidebar Skip to footer
Home / Mysql / Node.js / Sql

Inserting Variables Into Sql Query For Node-mysql

Post a Comment
In the wiki for node-mysql, I noticed that variables (kind of) were inserted into the SQL query in 2 different ways, one is by inserting a variable in the middle of the query strin

Solution 1:

Always favor option 2, since they are SQL injection proof. Option 1 will get your site hacked within 5 minutes, while hackers are going to have a hard time breaking option 2.

Even in performance option 2 may be a little bit faster.

However: Table names cannot be escaped with the ? so don't go there. Just make sure that users can't enter the table name manually and you'll be safe from hackers.

-edit-

Why would you want to make table names variable anyway?

Post a Comment for "Inserting Variables Into Sql Query For Node-mysql"