Joururi/spellsaurus
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- Added escape methods to queries for spells and schools

Browse Source
This commit is contained in:
Alexis
2020-05-16 16:46:44 +02:00
parent 8468fe235a
commit cf0a50efa3
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
routes/schools.js
View File

@@ -34,7 +34,7 @@ const getSchools = () => {
const getSchool = (id) => { const getSchool = (id) => {
let getSchoolPromise = new Promise((resolve, reject) => { let getSchoolPromise = new Promise((resolve, reject) => {
let query = "SELECT * FROM school WHERE id = " + id let query = "SELECT * FROM school WHERE id = " + db.escapeId(id)
db.query(query, async (err, result) => { db.query(query, async (err, result) => {
if (err) return reject if (err) return reject
@@ -100,7 +100,7 @@ const buildSchool = async (school) => {
let query = let query =
"SELECT ms.id, ms.name " + "SELECT ms.id, ms.name " +
"FROM meta_school AS ms " + "FROM meta_school AS ms " +
"WHERE ms.id = " + school.id_meta_school "WHERE ms.id = " + db.escapeId(school.id_meta_school)
db.query(query, (err, result) => { db.query(query, (err, result) => {
if (err) return reject if (err) return reject

8
routes/spells.js
View File

@@ -34,7 +34,7 @@ const getSpells = () => {
const getSpell = (id) => { const getSpell = (id) => {
let getSpellPromise = new Promise((resolve, reject) => { let getSpellPromise = new Promise((resolve, reject) => {
let query = "SELECT * FROM spell WHERE id = " + id let query = "SELECT * FROM spell WHERE id = " + db.escapeId(id)
db.query(query, async (err, result) => { db.query(query, async (err, result) => {
if (err) return reject if (err) return reject
@@ -152,7 +152,7 @@ const buildSpell = async (spell) => {
"SELECT school.id, school.name " + "SELECT school.id, school.name " +
"FROM spells_schools AS sc " + "FROM spells_schools AS sc " +
"INNER JOIN school AS school ON sc.id_school = school.id " + "INNER JOIN school AS school ON sc.id_school = school.id " +
"WHERE sc.id_spell = " + spell.id "WHERE sc.id_spell = " + db.escapeId(spell.id)
db.query(query, (err, result) => { db.query(query, (err, result) => {
if (err) return reject if (err) return reject
@@ -166,7 +166,7 @@ const buildSpell = async (spell) => {
"SELECT variable.id, variable.description " + "SELECT variable.id, variable.description " +
"FROM spells_variables AS sv " + "FROM spells_variables AS sv " +
"INNER JOIN variable AS variable ON sv.id_variable = variable.id " + "INNER JOIN variable AS variable ON sv.id_variable = variable.id " +
"WHERE sv.id_spell = " + spell.id "WHERE sv.id_spell = " + db.escapeId(spell.id)
db.query(query, (err, result) => { db.query(query, (err, result) => {
if (err) return reject if (err) return reject
@@ -180,7 +180,7 @@ const buildSpell = async (spell) => {
"SELECT ingredient.id, ingredient.name " + "SELECT ingredient.id, ingredient.name " +
"FROM spells_ingredients AS si " + "FROM spells_ingredients AS si " +
"INNER JOIN ingredient AS ingredient ON si.id_ingredient = ingredient.id " + "INNER JOIN ingredient AS ingredient ON si.id_ingredient = ingredient.id " +
"WHERE si.id_spell = " + spell.id "WHERE si.id_spell = " + db.escapeId(spell.id)
db.query(query, (err, result) => { db.query(query, (err, result) => {
if (err) return reject if (err) return reject