4 ms·
Is there any plausible reason why mysqljs should accept anything other than a string for the parameters array (second argument)? connection.query("SELECT * F
by 88913527 5y ago
Is there any plausible reason why mysqljs should accept anything other than a string for the parameters array (second argument)?
connection.query("SELECT * FROM accounts WHERE username = ? AND password = ?", [{username: {username: 1}}, "secret"]);
Without looking at the implementation details, I would expect this code to throw an exception. A "garbage in, garbage out" philosophy seems dangerous for a SQL statement.
- progforlyfe 5y agoIt looks like the article headline is slightly misleading. It says "Parameterized queries", but I wouldn't use that phrase to describe escaping data "client side" and sending the SQL query to the Database essentially as raw. Or maybe I am thinking of "Prepared statements", but I tend to use the terms interchangeably.