转义 Node.JS MySQL 问题

Question

我正在创建一个守护程序，它会自动在我的页面周围随机更改 MYSQL 表内容。 （wordpress 表格）

我有一系列故事，系统将读取它们，然后更新表中的 mysql，并更新服务器上的时间戳。

我的代码是这样的

//required libraries
fs = require('fs')
var mysql = require('mysql');
var dateFormat = require('dateformat');
var now = new Date();

//mysql table
var connection = mysql.createConnection({
  host     : 'yomamabinshoppin',
  user     : 'nonya',
  password : 'defineltynonya',
  database : 'okbye'
});


connection.connect();


//sitelisting
var sites = [ 'wp_counlwarehouseposts', 'wp_infounlwarehouseposts', 'wp_infowarehouse31posts', 'wp_netunlwarehouseposts', 'wp_netwarehouse31posts', 'wp_orgunlwarehouseposts', 'wp_orgwarehouse31posts', 'wp_stagcomwarehouseposts', 'wp_stagcowarehouseposts', 'wp_staginfwarehouseposts', 'wp_stagnetwarehouseposts', 'wp_stagorgwarehouseposts'];

//select story from catalogue
function ss (id,callback){
    fs.readFile('./' + id +'.txt', 'utf8', function (err,data) {
   callback(data);
});}

sites.forEach(function(entry) {
    ss(Math.floor(Math.random() * 12), function (returnvalue){
    fs.writeFile(entry, returnvalue);
    connection.query("UPDATE  `warehous_wordpress`.`"+entry+"` SET  `post_date` =  '"+ dateFormat(now, "yyyy-m-d") +" 01:00:01' WHERE `"+entry+"`.`ID` =1", function(err, rows, fields) {

 if (err) throw err;


});
 fs.appendFile('postlog.log', "UPDATE `warehous_wordpress`.`"+entry+"` SET `post_content` = '"+returnvalue+"' WHERE `"+entry+"`.`ID` = 1" , function (err) {

});
connection.query("UPDATE `warehous_wordpress`.`"+entry+"` SET `post_content` = '"+returnvalue+"' WHERE `"+entry+"`.`ID` = 1", function(err, rows, fields) {

 if (err) throw err;
 });

});


});

这里的问题在于

fs.appendFile('postlog.log', "UPDATE `warehous_wordpress`.`"+entry+"` SET `post_content` = '"+returnvalue+"' WHERE `"+entry+"`.`ID` = 1" , function (err) {

});

returnvalue 是我的故事，entry 是当前表名。

Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual th
at corresponds to your MySQL server version for the right syntax to use near 're
 frightened can become a safety issue. When designing something to scare visit'
at line 1

它所指的故事有这样的文字。

SCARE PEOPLE THE RIGHT WAY.
"We always try to scare forward to try to keep the flow going," Travis says. "A lot of times we try to scare further down the path rather than being scared into the wall," which slows the circulation of traffic through the maze.
Plus, where people instinctively move when they're frightened can become a safety issue. When designing something to scare visitors, you have to think about how people will react—and what they might jump into if they leaped backward in terror. "You never really know how bad something is going to scare somebody," Travis explains. "We try to keep the opposite wall clear from any kind of metal props or anything like that."

起初我认为这个问题与我的故事中的一些 html 有关，所以我删除了故事中的所有 html，同样的问题正在发生。

对我如何解决这个问题有什么建议吗？ 谢谢。

更新 1 为Query转义变量后，修改后的代码，在SQL端还是同样的解析问题

//required libraries
fs = require('fs')
var mysql = require('mysql');
var dateFormat = require('dateformat');
var now = new Date();

//mysql table
var connection = mysql.createConnection({
  ...
});


connection.connect();


//sitelisting
var sites = [ 'wp_counlwarehouseposts', 'wp_infounlwarehouseposts', 'wp_infowarehouse31posts', 'wp_netunlwarehouseposts', 'wp_netwarehouse31posts', 'wp_orgunlwarehouseposts', 'wp_orgwarehouse31posts', 'wp_stagcomwarehouseposts', 'wp_stagcowarehouseposts', 'wp_staginfwarehouseposts', 'wp_stagnetwarehouseposts', 'wp_stagorgwarehouseposts'];

//select story from catalogue
function ss (id,callback){
    fs.readFile('./' + id +'.txt', 'utf8', function (err,data) {
   callback(data);
});}

sites.forEach(function(entry) {
    ss(Math.floor(Math.random() * 12), function (returnvalue){
    fs.writeFile(entry, returnvalue);
    connection.query("UPDATE  `warehous_wordpress`.`"+entry+"` SET  `post_date` =  '"+ dateFormat(now, "yyyy-m-d") +" 01:00:01' WHERE `"+entry+"`.`ID` =1", function(err, rows, fields) {

 if (err) throw err;


});
 fs.appendFile('postlog.log', "UPDATE `warehous_wordpress`.`"+ entry + "` SET `post_content` = '"+ mysql.escape(returnvalue) +"' WHERE `"+ entry +"`.`ID` = 1" , function (err) {

});
connection.query("UPDATE `warehous_wordpress`.`"+ entry +"` SET `post_content` = '" + mysql.escape(returnvalue) + "' WHERE `"+ entry +"`.`ID` = 1", function(err, rows, fields) {

 if (err) throw err;
 });

});


});

Answer 1

您需要始终正确地转义变量。

如果您的returnvalue 是they're，那么您的这部分查询：

SET `post_content` = '" + returnvalue + "' WHERE

会变成：

SET `post_content` = 'they're' WHERE

如您所见，这将导致're 出现语法错误

在最坏的情况下，这可用于将一些数据注入您的数据库。如果returnvalue 例如将是they', ID='1，那么您的查询将是：

SET `post_content` = 'they', ID='1' WHERE

所以你总是必须escape你的价值观，使用?或mysql.escape

使用?? 和?：

connection.query(
  "UPDATE `warehous_wordpress`.?? SET `post_content` = ? WHERE ??.`ID` = 1",
  [entry, returnvalue, entry] , 
  function(err, rows, fields) {});

使用mysql.escapeId 和mysql.escape：

connection.query(
    "UPDATE `warehous_wordpress`." + mysql.escapeId(entry) +
    " SET `post_content` = " + mysql.escape(returnvalue) + 
    " WHERE " + mysql.escapeId(entry) + ".`ID` = 1",
    function(err, rows, fields) {});

我建议你使用? 和??。

Answer 2

试试下面的

fs = require('fs');
var mysql = require('mysql');
var dateFormat = require('dateformat');
var async = require('async');

var connection = mysql.createConnection({
    ...
});
connection.connect();

var sites = [ 'wp_counlwarehouseposts', 'wp_infounlwarehouseposts', ...];

function copyFile(source, target, callback) {
    var rs = fs.createReadStream(source);
    rs.on('error', callback);

    var ws = fs.createWriteStream(target);
    ws.on('error', callback);
    ws.on('close', callback);
    rs.pipe(wr);
}

function updateSite(site, callback) {
    copyFile('./' + Math.floor(Math.random() * 12) +'.txt', site, function(err) {
        if (err)
            return callback(err);

        connection.query(
            'UPDATE  warehous_wordpress.? SET post_date = ? WHERE ?.ID=1', 
            [site, dateFormat(now, 'yyyy-m-d') + ' 01:00:01', site], 
            callback
        );
    });
}

async.eachSeries(sites, updateSite, function (err) { if (err) throw err; });