How come I'm getting a syntax error in my SQL code?

Question

I'm getting an error on the line that says

const INSERT_PRODUCTS_QUERY = 'INSERT INTO products(name, price) VALUES('${name}',${price})';

I know the error emanates from the single quotes in '${name}' but I also tried removing the single quotes in an attempt to get rid of this error and still get an error that says:

{
"code": "ER_PARSE_ERROR",
"errno": 1064,
"sqlMessage": "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{name}, ${price})' at line 1",
"sqlState": "42000",
"index": 0,
"sql": "INSERT INTO products(name, price) VALUES(${name}, ${price})"
}

Here's my code:

const express = require('express');
const cors = require('cors');
const mysql = require('mysql');

const app = express();

const SELECT_ALL_PRODUCTS_QUERY = 'SELECT * FROM products';

const connection = mysql.createConnection({
    host: 'localhost',
    user: 'root',
    password: 'password',
    database: 'react_sql'
});

connection.connect(err => {
    if(err) {
        return err;
    }
});

app.use(cors());

app.get('/', (req, res) => {
    res.send('go to /products to see products')
});

app.get('/products/add', (req, res) => {
    const { name, price } = req.query;
    const INSERT_PRODUCTS_QUERY = 'INSERT INTO products(name, price) VALUES('${name}',${price})';

    connection.query(INSERT_PRODUCTS_QUERY, (err, results) => {
       if(err) {
           return res.send(err);
       } else {
           return res.send('successfully added products');
       }
    });

})

app.get('/products', (req, res) => {
    connection.query(SELECT_ALL_PRODUCTS_QUERY, (err, results) => {
        if(err) {
            return res.send(err)
        } else {
            return res.json({
                data: results
            })
        }
    });
});

app.listen(4000, () => {
    console.log("listening port 4000");
});

Answer 1

I don't know so much about SQL and its queries, so for this subject (strings, security, etc) listen to other people.

As you can see in the comments this opens the code to SQL Injections, better avoid to using it.

Thanks, @Keith.

---

But if you want to use variables in your strings either you need to combine different string pieces or you should use template literals.

PS: If you still really, really want to use template literals, you can check this node package which is sql-template-strings for NodeJS.

Notice the backticks: ``

const name = "foo";
const price = 100;

const INSERT_PRODUCTS_QUERY = `INSERT INTO products(name, price) VALUES('${name}',${price})`;

console.log( INSERT_PRODUCTS_QUERY );

Answer 2

SQL parameters in MySQL are not only a convenient way of passing parameters to query's, there also a must if you don't want to open your site to SQL Injection problems.

The changes you need to make are very minimal..

First change your query to ->

const INSERT_PRODUCTS_QUERY = 
   'INSERT INTO products(name, price) VALUES(?, ?)'

And when you use this query pass the parameters as the second parameter.

connection.query(SELECT_ALL_PRODUCTS_QUERY, 
  [name, price],
  (err, results) => {

Answer 3

Template literals are not surrounded by simple quotes but by back-ticks "`"

It should become :

const INSERT_PRODUCTS_QUERY =  `INSERT INTO products(name, price) VALUES('${name}',${price})`

Answer 4

You are not providing literals correctly, modify your query as following, this is PHP representation you can change accordingly.

INSERT INTO products(name, price) VALUES('".${name}."','".${price}."');

Single quote for literal value is ambiguous with language single quote, which breaks query syntax.

This is not best way to achieve this, as it opens your query to SQL Injection.