Is mysql.format in nodejs MYSQL safe from unescaped input?
I've hear that preparing MySQL queries prevents injection. I'm working with nodejs, so I've found MySql Preparing Queries. According to the documentation,
You can use mysql.format to prepare a query with multiple insertion
points, utilizing the proper escaping for ids and values.
Does that mean that I can put unescaped things in userId and get an escaped mysql request called sql?
The code is:
var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts);
mysql node.js database
asked Nov 20 at 18:53
Guerlando OCs
1233
add a comment |
I've hear that preparing MySQL queries prevents injection. I'm working with nodejs, so I've found MySql Preparing Queries. According to the documentation,
You can use mysql.format to prepare a query with multiple insertion
points, utilizing the proper escaping for ids and values.
Does that mean that I can put unescaped things in userId and get an escaped mysql request called sql?
The code is:
var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts);
mysql node.js database
asked Nov 20 at 18:53
Guerlando OCs
1233
add a comment |
I've hear that preparing MySQL queries prevents injection. I'm working with nodejs, so I've found MySql Preparing Queries. According to the documentation,
You can use mysql.format to prepare a query with multiple insertion
points, utilizing the proper escaping for ids and values.
Does that mean that I can put unescaped things in userId and get an escaped mysql request called sql?
The code is:
var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts);
mysql node.js database
asked Nov 20 at 18:53
Guerlando OCs
1233
I've hear that preparing MySQL queries prevents injection. I'm working with nodejs, so I've found MySql Preparing Queries. According to the documentation,
You can use mysql.format to prepare a query with multiple insertion
points, utilizing the proper escaping for ids and values.
Does that mean that I can put unescaped things in userId and get an escaped mysql request called sql?
The code is:
var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts);
mysql node.js database
mysql node.js database
asked Nov 20 at 18:53
Guerlando OCs
1233
asked Nov 20 at 18:53
Guerlando OCs
1233
asked Nov 20 at 18:53
Guerlando OCs
1233
asked Nov 20 at 18:53
Guerlando OCs
1233
asked Nov 20 at 18:53
Guerlando OCs
1233
1233
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
It's safe.
Escaping is performed by the sqlstring module, you can take a look at its source code for additional info, it's rather small.
You should always escape your values, either by using the ? placeholders or calling escape directly. However using the placeholders is more recommended because it protects you from scenarios where you might forget to do the manual escaping.
answered Nov 21 at 14:27
mihai
23.3k73968
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53399686%2fis-mysql-format-in-nodejs-mysql-safe-from-unescaped-input%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's safe.
Escaping is performed by the sqlstring module, you can take a look at its source code for additional info, it's rather small.
You should always escape your values, either by using the ? placeholders or calling escape directly. However using the placeholders is more recommended because it protects you from scenarios where you might forget to do the manual escaping.
answered Nov 21 at 14:27
mihai
23.3k73968
add a comment |
It's safe.
Escaping is performed by the sqlstring module, you can take a look at its source code for additional info, it's rather small.
You should always escape your values, either by using the ? placeholders or calling escape directly. However using the placeholders is more recommended because it protects you from scenarios where you might forget to do the manual escaping.
answered Nov 21 at 14:27
mihai
23.3k73968
add a comment |
It's safe.
Escaping is performed by the sqlstring module, you can take a look at its source code for additional info, it's rather small.
You should always escape your values, either by using the ? placeholders or calling escape directly. However using the placeholders is more recommended because it protects you from scenarios where you might forget to do the manual escaping.
answered Nov 21 at 14:27
mihai
23.3k73968
It's safe.
Escaping is performed by the sqlstring module, you can take a look at its source code for additional info, it's rather small.
You should always escape your values, either by using the ? placeholders or calling escape directly. However using the placeholders is more recommended because it protects you from scenarios where you might forget to do the manual escaping.
answered Nov 21 at 14:27
mihai
23.3k73968
answered Nov 21 at 14:27
mihai
23.3k73968
answered Nov 21 at 14:27
mihai
23.3k73968
answered Nov 21 at 14:27
mihai
23.3k73968
23.3k73968
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53399686%2fis-mysql-format-in-nodejs-mysql-safe-from-unescaped-input%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
