Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prepared statements - support escaped property names in JSON path #703

Closed
amozh-op opened this issue Jan 5, 2018 · 1 comment
Closed

Comments

@amozh-op
Copy link

amozh-op commented Jan 5, 2018

We use prepared statements and named parameters everywhere in our project and it is really useful. Great job!

Additionally we have started actively using JSON and i have faced with an issue in next query:

SELECT * FROM table WHERE jsonColumn->>'$."propertyName"' = :p1

and parameters object:

{
  p1: 'propertyValue'
}

Parameter p1 is never replaced by it's value and query gets executed in MySql as is, hence i get an SQL syntax error near :p1.

The issue happens because propertyName is escaped with double quotes and named-placeholders library has some specific logic around double quotes here:
https://github.com/mysqljs/named-placeholders/blob/master/index.js#L36

I really need to escape property name in JSON object because it may contain special characters which break SQL query.

@sidorares
Copy link
Owner

hi @amozh thanks for report! moved to mysqljs/named-placeholders#10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants