javascript - Express.js - error when trying to pull data from mysql -

-

i using following controller action:

exports.search = function(req, res) {  var x = [];  if (req.query.criteria == 'language') {     var langquery ="select * languages language '%" + req.query.val + "%' order verbal desc";      client.query(langquery, function(err, results) {         if (err) {             throw err;         }          client.query('select * humans', function(err, hmns) {             if (err) {                 throw err;             }              for(var = 0; < results.length; i++) {                 for(var j = 0; j < hmns.length; j++) {                     if(hmns[j].request == results[i].request) {                         x.push(hmns[j]);                     }                 }             }              res.render('allhumans', { title: 'search results', humans: x});         });     }); }else{     var query = "select * humans " + req.query.criteria + " '%" + req.query.val + "%'";      client.query(query, function(err, results) {         if (err) {             throw err;         }          res.render('allhumans', { title: 'search results', humans: results});     }); }   }

my languages table has following columns (id excluded): request, language, verbal, writing, assessor

i have following entries:

request | language | verbal | writing | assessor  req123       ru         3         3       name req123       en         4         4       name req321       ru         5         5       name  req321       en         2         3       name

when search ru, code executes perfectly, when search en returns empty array. why that?

looking forward feedback!

thank you!

edit: humans table has request column unique every human entry. request column in languages table foreign key. (one human can have more language skills) req.query.val ru when search ru (works perfectly) , en when try search en.

edit1: human entries:

request | first name | last name | contact req123      john         trump      000 req321      mary         jane       000

edit2: i've fixed it! have modified loop. think problem :) have updated code in post well. still, tried escaping values before inserting data table using ( client.escape() - function provided mysql node module), breaks all! following error:

er_parse_error: have error in sql syntax;  check manual corresponds mysql server  version right syntax use near 'e'%' order verbal desc'  @ line 1

for reason, after escaping data, adds single quotation marks , breaks query.

you assuming y (holding request rows if of given language) @ least long "all humans" (resultss), seems me false.

in addition, not escaping req.query.criteria , req.query.val, leaving wide open sql injection attacks. should fix :)

(it others if posted actual error message getting. , if showed few human rows).


Comments

Post a Comment

Popular posts from this blog

java - activate/deactivate sonar maven plugin by profile? -

-
i use sonar plugin executes if activated in maven profile. sonar runs on every compile. the problem build fail other team members not have sonar application installed locally. pom.xml checked in team members same copy including sonar configuration, don't want them modify purpose of disabling sonar (they might inadvertently check modified copy in). please advise how configure maven (.m2/settings.xml) and/or pom.xml sonar feature can enabled/disabled local profile. here sonar configuration in each project's pom.xml: <plugin> <groupid>org.codehaus.mojo</groupid> <artifactid>sonar-maven-plugin</artifactid> <version>1.0</version> <executions> <execution> <id>make-sonar</id> <phase>compile</phase> <goals> <goal>sonar</goal> </goals> </execution> </executions> ...
Read more

python - TypeError: can only concatenate tuple (not "float") to tuple -

-
i'm new python, question might easy, anyway, patience: as trying call newton-raphson method calculate implied volatility in black-scholes formula call/put option pricing, first thing is, newton method in scipy.optimize seems calculate function's zeros, in black-scholes formula, want function's value option price, not zero. (i'm new here programming, i'm not sure techniques.) should write function things like: def f(sigma, price): return bsformula(s0,k,r,t,q,sigma) - price then, while calling newton method, takes args=() 1 parameter in function, write this: value = newton(bsprice2, 0.5, args=price) but error message: file "bs.py", line 36, in bsimpvol value = newton(bsprice2, 0.5, args=float(price)) file "/usr/lib/python2.7/dist-packages/scipy/optimize/zeros.py", line 143, in newton q0 = func(*((p0,) + args)) typeerror: can concatenate tuple (not "float") tuple could tell me why that? how fix it? apprecia...
Read more

java - What is the difference between String. and String.this. ? -

-
this question has answer here: meaning of .this , .class in java 2 answers i'll straight point. im still learning bit of syntax , want know difference between code is code a: public class buttonz extends jbutton{ public buttonz(){ settext(new string(string.valueof(i))); } } please ignore fact i undeclared, not lost. code b: public class buttonz extends jbutton{ public buttonz(){ settext(new string(string.this.charat(i))); } } what don't yet understand difference in typing string.this , string. i under assumption when use dot operator on class accessing it's static methods(and/or variables if they're not hidden). i have studied little bit , have concluded when using string. accessing string static methods.. when using string.this. i'm accessing methods class buttonz extendi...
Read more