Can't seem to query specific things using node-mysql with JavaScript

Question

p_info_query('SELECT * FROM ' + <table> + ' WHERE name = ' + user_name, password, client_connect.id, p_info, function(results) {

This seems to produce a Unknown Column 'user_name'. I searched online for some examples of people doing this, but I couldn't find any. I want to query for specific things, maybe even comparing 2 values, user and password.

Any help?

// edited for p_info_query function

function p_info_query(sql, password, client_socket_id, player_info_object, callback) {
  var result =  mysql_client.query(sql, function (error, results, fields) {
    if (error) {
        console.log('ERROR IN MYSQL LOGIN CALLBACK : '+ error);
        return false;
    }
    if (results.length  > 0) {

    // do stuff


    callback(true);
    } else {

    callback(false);
    }
    }
});

I am using: https://github.com/felixge/node-mysql and user_name is a variable that contains the user_name the client wanted to log into. — user1328762, Apr 15 '12 at 03:56

mu is too short · Accepted Answer · 2012-04-15T05:16:15.033

0

Your problem is that you're not quoting the user_name so you end up with SQL like this:

select * from table where name = whatever

where whatever is the value of user_name, an unquoted value like that is parsed as an identifier (essentially a column name in that context), hence your "unknown column" error.

Presumably p_info_query is something of your own as it isn't part of node-mysql. You should modify it to use placeholders so that it can do things like this internally:

client.query(
    'select * from ' + table_name + ' where name = ?',
    [ user_name ],
    function(err, results, fields) { /* ... */ }
);

Note the ? in the SQL and the [user_name] array.

Now that we know what p_info_query looks like, we can fix that too; you should update it look more like this:

function p_info_query(sql, params, password, client_socket_id, player_info_object, callback) {
  var result =  mysql_client.query(sql, params, function (error, results, fields) {
    // ...

Then you can say this:

p_info_query(
  'SELECT * FROM ' + table_name + ' WHERE name = ?',
  [user_name],
  password,
  client_connect.id,
  p_info,
  function(results) { /* ... */ }
);

to use a placeholder.

edited Apr 15 '12 at 05:16

answered Apr 15 '12 at 04:08

mu is too short

426,620
70
833
800

this results in an "Error: You have an error in your .... right syntax to use near '?' at line 1. p_info_query('SELECT * FROM ' + table_name + ' WHERE user = ?',[user_name], password, client_connect.id, p_info, function(results) { And yes, this is just part of my callback – user1328762 Apr 15 '12 at 04:26
What is this `p_info_query` function? Where does it come from? – mu is too short Apr 15 '12 at 04:29
@user1328762: I don't think you updated `p_info_query` properly, please see my update. – mu is too short Apr 15 '12 at 04:45
omg. thank you so much! That works great! Good thing I asked, cause I would have never figured it out :0 – user1328762 Apr 15 '12 at 04:52

Can't seem to query specific things using node-mysql with JavaScript

1 Answers1