Closed modulitos closed 6 years ago
Parameters are a PostgreSQL concept, not just a pg invention. They’re expressions and don’t work by simple string replacement. This is consistent with how you would select a string:
pool.query(`SELECT $1`, ['example'])
and not
pool.query(`SELECT '$1'`, ['example'])
One safe correction to your example (${longitude} ${latitude}
is unsafe by default and could lead to SQL injection):
const query =
`
SELECT statefp, name, stusps
FROM my_table as tb
WHERE st_contains(tb.geom, st_geomfromtext('POINT(' || $1 || ' ' || $2 || ')', 4269))
`
const states = await client.query(
query,
[ longitude, latitude ]
)
Rather than serializing and bind the geo types as text, you can directly create a point via: POINT(x,y)
@charmander @sehrope Thanks for the explanation - this makes a lot more sense now.
Closing this issue :-)
For example, I was running the following query:
which gave me the following error:
It's as if my query wasn't accepting any parameters, but as we can clearly see above, it takes the
$1
and$2
parameters. After about an hour of trying to figure out what went wrong, I realized that my parameters are inside of a quoted string (ie'POINT($1 $2)'
). Perhaps this is a bug, or a feature, where params inside of a quoted string are not parsed bypg-pool
's client?I think this strange behavior should at least be documented. If so, I'm happy to help with that.
In the end, the following refactor fixed it: