0

here is what I have so far 

con.query(`SELECT * FROM messages WHERE guildID = ${message.guild.id} AND username = ${message.author.username}; `)
    con.query(`SET messagesSent = messagesSent + 1;`)

how would I add 1 to messages sent when the user sends a message under that username and guild id?

jerry
  • 59
  • 11
  • With an [UPDATE statement](https://dev.mysql.com/doc/refman/8.0/en/update.html): `UPDATE messages SET messagesSent = messagesSent + 1 WHERE guildID = ${message.guild.id} AND username = ${message.author.username};` That being said, instead of concatenating your sql string together, instead use parameters to bind your `message.guild.id` and `message.author.username` into your sql. This will insure you don't suffer a SQL injection attack should someone manage to make their `message.author.username` something like `1;drop table messages;--` – JNevill Feb 11 '19 at 18:03
  • @JNevill this is the error I get Error: ER_BAD_FIELD_ERROR: Unknown column 'Jerry' in 'where clause' – jerry Feb 11 '19 at 18:08
  • You'll need single quotes around your the string literal in your sql. So `UPDATE messages SET messagesSent = messagesSent + 1 WHERE guildID = ${message.guild.id} AND username = '${message.author.username}';` Again, consider [binding parameters](https://stackoverflow.com/questions/41168942/how-to-input-a-nodejs-variable-into-an-sql-query) to avoid this. The last example shared by the top answer there is an example of this using the `?` character in the sql. – JNevill Feb 11 '19 at 18:24
  • @JNevill ok so how would I call it? like to a user info command? – jerry Feb 11 '19 at 18:26

0 Answers0