使用node.js将json导入到mysql中

我试图插入在node.js中创build的JSON到MySQL中，但有一个语法错误，我不能纠正错误，任何帮助将不胜感激

我的代码

flowController.on('2', function (_selfid,_participantId,_groupid,_allMemberContent) { var allMemberDetailSQL= "SELECT spFunAllMemberNotificationDetails("+ _selfid + "," + _participantId +") as groupparticipants"; console.log("allMemberDetailSQL"+allMemberDetailSQL); client.query(allMemberDetailSQL,function(detailERROR,detailResult) { if (detailERROR) console.log("detailERROR "+ detailERROR); else { var detailstr=''; detailstr = JSON.stringify(detailResult); console.log('detailResult :'+ detailstr); console.log("detailResult "+detailResult[0].groupparticipants); var otherArray = [detailResult[0].groupparticipants]; var _allMemberDetail = JSON.stringify({ selfid: _selfid, groupid: _groupid, anArray: otherArray }); console.log("_allMemberDetail " +_allMemberDetail); var allMemberDetail = "'"+_allMemberDetail+"'"; console.log("allMemberDetail "+allMemberDetail); client.query("INSERT INTO cmNotification (notificationSenderId, notificationReceiverId)"+"VALUES('"+_selfid+"','"+ _allMemberDetail+ "');", function(err, rows) { console.log("error insert "+err); console.log("rows insert"+rows); //connection.release(); }); } }); 

}）;

控制台输出

 allMemberDetailSQLSELECT spFunAllMemberNotificationDetails(20,16) as groupparticipants detailResult :[{"groupparticipants":"userid:'15',firstname:'pitu15',lastname:'',isfriend:'1',profilepicurl:''"}] detailResult userid:'15',firstname:'pitu15',lastname:'',isfriend:'1',profilepicurl:'' _allMemberDetail {"selfid":"20","groupid":"15","anArray":["userid:'15',firstname:'pitu15',lastname:'',isfriend:'1',profilepicurl:''"]} allMemberDetail '{"selfid":"20","groupid":"15","anArray":["userid:'15',firstname:'pitu15',lastname:'',isfriend:'1',profilepicurl:''"]}' detailResult :[{"groupparticipants":"userid:'16',firstname:'pitu16',lastname:'',isfriend:'0',profilepicurl:''"}] detailResult userid:'16',firstname:'pitu16',lastname:'',isfriend:'0',profilepicurl:'' _allMemberDetail {"selfid":"20","groupid":"15","anArray":["userid:'16',firstname:'pitu16',lastname:'',isfriend:'0',profilepicurl:''"]} allMemberDetail '{"selfid":"20","groupid":"15","anArray":["userid:'16',firstname:'pitu16',lastname:'',isfriend:'0',profilepicurl:''"]}' error insert Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '15',firstname:'pitu15',lastname:'',isfriend:'1',profilepicurl:''"]}')' at line 1 rows insertundefined error insert Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '16',firstname:'pitu16',lastname:'',isfriend:'0',profilepicurl:''"]}')' at line 1 rows insertundefined 

Answer 1

使用内置的参数转义来防止sql注入攻击。 “INSERT INTO … SET？” 也让生活更轻松：

 client.query("INSERT INTO cmNotification SET ?", {notificationSenderId: _selfid, notificationReceiverId: _allMemberDetail}, function(err, rows) { // ... });