maria db insertion -sql injection -error

Question

I am trying to insert values into a database (MariaDB) using SQL injection.

var insertValues = {'username': username, 'firstname': firstname, 'lastname': lastname, 'email': email,
                        'password':password, 'profileType': profileType,'userType': userType, 'gcmId': gcmId,
                        'deviceName': deviceName, 'osType': osType, 'osVersion': osVersion,'isBlocked':isBlocked,
                        'isActive':isActive, 'ofActive':ofActive};

The query format I used is:

    function registerUser(insertValues,callback)
{
    model.client.query('insert into users set ?',insertValues,function(err) {
      if(!err)
            callback({"success":'1'});
        else
            console.log(err);
            callback({"success":'0'});
    });
}
module.exports.registerUser=registerUser;

But this gives a syntax error:

Maria Db Connected at : 128.199.242.240
{ [Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'NULL' at line 1] code: 1064 }

Show us the INSERT after the ? has been replaced.

Rick James
– Rick James

2016-06-30 22:00:09 +00:00
Commented Jun 30, 2016 at 22:00 — Rick James
– Rick James, Commented Jun 30, 2016 at 22:00

Daniel W. · Accepted Answer · 2016-06-17 12:12:48Z

1

Two mistakes:

model.client.query("insert into users set ?",data;
                      column missing -----^
                  closing parantheses missing ---^

Should be something like:

model.client.query("insert into users set your_column = ?", data);

answered Jun 17, 2016 at 12:12

Daniel W.

32.6k15 gold badges99 silver badges155 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

maria db insertion -sql injection -error

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related