国产av日韩一区二区三区精品,成人性爱视频在线观看,国产,欧美,日韩,一区,www.成色av久久成人,2222eeee成人天堂

Use escape() to encode the incoming parameters

var userId = 1, name = 'test';
var query = connection.query('SELECT * FROM users WHERE id = ' + connection.escape(userId) + ', name = ' + connection.escape(name), function(err, results) {
    // ...
});
console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = 'test'

Use query parameter placeholders for connection.query()

var userId = 1, name = 'test';
var query = connection.query('SELECT * FROM users WHERE id = ?, name = ?', [userId, name], function(err, results) {
    // ...
});
console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = 'test'

Use escapeId() to encode SQL query identifiers

var sorter = 'date';
var sql    = 'SELECT * FROM posts ORDER BY ' + connection.escapeId(sorter);
connection.query(sql, function(err, results) {
  // ...
});

Use mysql.format() to escape parameters

var userId = 1;
var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts); // SELECT * FROM users WHERE id = 1

Ref: http://www.dengzhr.com/node-j...

PS: The first page of Google is the answer