Open everlose opened 3 years ago
insert 插入
> sql.table('product').data({name: '"sdsd"'}).insert() `INSERT INTO product (name) VALUES ('\\"sdsd\\"')` > sql.table('product').data({name: '```var date = new Date()```'}).insert() "INSERT INTO product (name) VALUES (''''var date = new Date()'''')"
看起来你防住了 ",但是没有防住 `
哦我明白了,看起来你是吧 ` 强行转为了 '
const sqlStr = `SELECT ${result.replace(/'/g, '\'').replace(/`/g, '\'')} `;
这句话可以去掉 replace(/`/g, '\'') 的描述吧
replace(/`/g, '\'')
insert 插入
看起来你防住了 ",但是没有防住 `