last day (14 days later) » 

12:20 PM
-1
Q: Nodejs mysql escape backslash in LIKE

WcanI'm using node-mysql to handle node connections and queries, I've used ? placeholder instead of using direct params vaiables to prevent SQL injection, my query looks like as following. I'm just showing the code which is necesary. I've also looked at this posts but couldn't solve the problem 1: N...

 
No, I;ve already checked this one, it suggest using placeholder which I'm using already but still / forward slash and backslash is not escaping
 
You followed the link to github and tried mysql.escape ? Alternate \\ or \/ should work.
I missed that you use table names with slash or bslash. You have to surround the table name with backticks `````, Why do you use this weird table names (I suggest to just use letters and _).
 
@BitAccesser Let me check it
I dont know why does people down vote for a genuine question
I already tried mysql.escape ots same as connection.escape
Is it possible if it has anythng to do with sending data via post or get method ?
 
No, it's the missing backticks!!
 
12:20 PM
@BitAccesser Please take a look at query I've updated the query now the table name is surrounded with back-ticks and I'm using ? placeholder for req.params.search which is same as using mysql.escape() according to the documentation.
I didn't any thing related to "\\ or \/ s" in the documentation, can you please tell me where and how should i use it according to my current query structure
 
You are confusing me! Did you provide table name and where condition in one ? placeholder before your edit? Why is the var still named table? What is result if you display query string in console? \ is mysql escapestring dev.mysql.com/doc/refman/5.7/en/string-literals.html
 
12:36 PM
OK, 1: so when you are using placeholder you need to define "what is it you wana replace it with" so i said replace question mark with "req.params.search" which is in the "table" variable, 2: second thing is query the query is with the "query1" variable so i put both of these in to mysql.format and that it, it work absolutely fine, but the only problem is with the / and \ these are not getting escaped even by ? which uses mysql.escape behind the scenes.
 
This made me think you want to put a table name with slashes and no where condition. Is NO_BACKSLASH_ESCAPES set on server dev.mysql.com/doc/refman/5.7/en/sql-mode.html?
 
should my query be looking like this ?
SELECT COUNT(*) AS recordsTotal FROM es_officers WHERE es_officer_name LIKE '\'%abc%\''
 
1:00 PM
I think issue is parameter surrounded by %. Try LIKE CONCAT('%', ? ,'%') as shown here dev.mysql.com/doc/refman/5.7/en/… on second comment by Ami Chayun. Output the query string to console or alert box, then test it in MySQL Workbench.
What names should match? Give some examples.
 
1:16 PM
Just dump data but you can look for abc, cde, efg, let me check this new link
 
1:35 PM
I don't know why but its is working find when the data is sent via post method and it doesn't work when i send the data via get method, I guess i will have to stick to post for now. I really appreciate your help :) Thank you so very much
 
1:46 PM
Your're welcome! I was not able to help you much, but I learned a lot.
FYI , if you want identifiers(tables,cols) as parameter use ??, then they are backticked github.com/felixge/node-mysql#escaping-query-identifiers.
 

last day (14 days later) »