Description
How can I return results with parameterized query in Nodejs? If I'm concatenating parameters into the query text directly, I can return results just fine. Problems arise with parameterized query. If I have to concatenate into the query, it opens my entire software to SQL Injections which defies the purpose of using parameterized queries. Could it be that pg is reading the $1 as part of the literal string instead of a placeholder because it is wrapped in quotes? If so, how do I fix this?
Similar issues here, here and here
Tried solutions here and here. None worked at returning results for me.
Query runs fine if I remove RETURNING* or runs fine if I'm concatenating parameters directly in query.
Right now, server returns this error
error: syntax error at or near "RETURNING"
server.js
//load module
const { Pool, Client } = require('pg');
//get variables
var userid = JSON.stringify(coords.userid);//23
var long = JSON.stringify(coords.longitude);//-81.363124
var lat = JSON.stringify(coords.latitude);//28.627777
var coords = JSON.stringify([long,lat]);//[-81.363124,28.627777]
const text = "UPDATE users SET info = JSONB_SET(info, '{geometry,coordinates}', '"+coords+"') WHERE id=$1 RETURNING*";
const values = [id];
pool.query(text, values, (err, res) => {
if (err) {
//log errors
console.log(err.stack);
//return error to client
} else {
//success
//console.log(res.rows);
}
});