2 回答
TA贡献1795条经验 获得超7个赞
根据您的环境,您还应该对查询值进行转义。如果你使用mysql,你应该可以接受这样的东西:
app.post('/visitors/store', (req, res) => {
const name = req.body.name;
const company = req.body.company;
con.query("INSERT INTO visitors(name, company) VALUES(?,?)", [name, company], (results) => {
res.json(results);
});
或不转义:
app.post('/visitors/store', (req, res) => {
const name = req.body.name;
const company = req.body.company;
con.query(`INSERT INTO visitors(name, company) VALUES(${name}, ${company})`, (results) => {
res.json(results);
});
TA贡献1806条经验 获得超5个赞
只需制动查询字符串,并在其中包含实际变量:
app.post('/visitors/store', (req, res) => {
const name = req.body.name;
const company = req.body.company;
con.query("INSERT INTO visitors(name, company) VALUES('" + name + "','" + company + "')", (results) => {
res.json(results);
});
});
- 2 回答
- 0 关注
- 101 浏览
添加回答
举报