WebReflection / dblite

sqlite for node.js without gyp problems
MIT License
209 stars 34 forks source link

Cannot escape dollar sign $ while insert the database query #58

Closed reidsneo closed 2 years ago

reidsneo commented 2 years ago

Hello I'm trying to use the libs it looks good but it having issue during processing the dollar sign $

bcrypt.hash(password, bcrypt.genSaltSync(saltRounds) , null, function (err, hash) {
            const insertUsers = 'INSERT INTO users (username, password) VALUES ("kerupukceleng", "$2a$10$IWEAROjtixonnkJ6OJ1Y5.mJCeP54HUi6IaEzAJd74HtzmcoC62Mi");';
            console.log(insertUsers);
            db.query(insertUsers);
        });

but giving me error

\node_modules\dblite\build\dblite.node.js:771
  return escape(paramsObject[key]);
                            ^

TypeError: Cannot read properties of undefined (reading '2a$10$IWEAROjtixonnkJ6OJ1Y5')

Thank you

WebReflection commented 2 years ago

This is how you should write queries to ensure no SQL injection is possible:

const insertUsers = 'INSERT INTO users (username, password) VALUES (?, ?);';
db.query(insertUsers, ["kerupukceleng", "$2a$10$IWEAROjtixonnkJ6OJ1Y5.mJCeP54HUi6IaEzAJd74HtzmcoC62Mi"]);
reidsneo commented 2 years ago

Sorry it was my mistake which the query isn't escaped by default but need using using a prepare statement instead. Also in production I need to copy sqlite3.exe to directory of the executable I generate to make this dblite module work, it's great! it's hard to working with native library .node really pulling out my hair, this library is a live saver!

Thank you, closing the thread now

WebReflection commented 2 years ago

@reidsneo I have just published a modern alternative to this project which does a much better job, imho: https://github.com/WebReflection/sqlite-tag-spawned#readme

Please have a look and let me know ... and btw, you can specify a different executable in here, just db.bin = "fuill path of your sqlite3" and you're done. In the modern project that's {bin: sqlite3_path} as second argument, the first one is the db name, and in memory does not work at all.

WebReflection commented 2 years ago

and in memory does not work at all.

... never mind, I've just found a solution for an in :memory: database, if interested