如何在NodeJs REST API中从mysql获取特定数据

Question

这是我的数据库：

这是我的代码

//Read by jenis_kelamin
router.get('/:table/jk/:jenis_kelamin', function(req, res) {
	sequelize.query("SHOW KEYS FROM `"+TABLE_PREFIX+req.params.table+"` WHERE Key_name = 'PRIMARY'", { type: sequelize.QueryTypes.SELECT})
	.then(function(keys) {
		var jenis_kelamin =req.params.jenis_kelamin;
		sequelize.query("SELECT * FROM `"+TABLE_PREFIX+req.params.table+"` WHERE jenis_kelamin = `"+jenis_kelamin+"` ", { type: sequelize.QueryTypes.SELECT})
		.then(function(rows) {
			if(!rows.length) {
				res.status(404);
				res.json({
					"success" : 0,
					"data" : "No rows found"
				});
			}
			res.status(200);
			res.json({
				"success" : 1,
				"data" : rows
			});
		})
		.catch( function(err) {
			res.status(404);
			res.send({
				"success" : 0,
				"message" : err.message
			});
		});
	})
	.catch( function(err) {
		res.status(404);
		res.send({
			"success" : 0,
			"message" : err.message
		});
	});
});

我想获取表'siswa'中的字段，其中'jenis_kelamin'='starfish'。使用上面的代码，但出现此错误：

{
    "success": 0,
    "message": "ER_BAD_FIELD_ERROR: Unknown column 'starfish' in 'where clause'"
}

有人可以帮助我吗？

Answer 1

请尝试

//Read by jenis_kelamin
router.get('/:table/jk/:jenis_kelamin', function(req, res) {
    sequelize.query("SHOW KEYS FROM '"+TABLE_PREFIX+req.params.table+"' WHERE Key_name = 'PRIMARY'", { type: sequelize.QueryTypes.SELECT})
    .then(function(keys) {
        var jenis_kelamin =req.params.jenis_kelamin;
        sequelize.query("SELECT * FROM '"+TABLE_PREFIX+req.params.table+"' WHERE jenis_kelamin = '"+jenis_kelamin+"' ", { type: sequelize.QueryTypes.SELECT})
        .then(function(rows) {
            if(!rows.length) {
                res.status(404);
                res.json({
                    "success" : 0,
                    "data" : "No rows found"
                });
            }
            res.status(200);
            res.json({
                "success" : 1,
                "data" : rows
            });
        })
        .catch( function(err) {
            res.status(404);
            res.send({
                "success" : 0,
                "message" : err.message
            });
        });
    })
    .catch( function(err) {
        res.status(404);
        res.send({
            "success" : 0,
            "message" : err.message
        });
    });
});

这也应该起作用

//Read by jenis_kelamin
router.get('/:table/jk/:jenis_kelamin', function(req, res) {
    sequelize.query("SHOW KEYS FROM '"+TABLE_PREFIX+req.params.table+"' WHERE Key_name = 'PRIMARY'", { type: sequelize.QueryTypes.SELECT})
    .then(function(keys) {
        var jenis_kelamin =req.params.jenis_kelamin;
        return sequelize.query("SELECT * FROM '"+TABLE_PREFIX+req.params.table+"' WHERE jenis_kelamin = '"+jenis_kelamin+"' ", { type: sequelize.QueryTypes.SELECT})
    })
    .then(function(rows) {
        if(!rows.length) {
            res.status(404);
            res.json({
                "success" : 0,
                "data" : "No rows found"
            });
        }
        res.status(200);
        res.json({
            "success" : 1,
            "data" : rows
        });
    })
    .catch( function(err) {
        res.status(404);
        res.send({
            "success" : 0,
            "message" : err.message
        });
    });
});

最后

router.get('/:table/jk/:jenis_kelamin', function(req, res) {

    const myTableName = sanitizeTableName(req.params.table) 
    const myFieldValue = santizeValue(req.params.jenis_kelamin)

    sequelize.query("SHOW KEYS FROM '"+ TABLE_PREFIX + myTableName +"' WHERE Key_name = 'PRIMARY'", { type: sequelize.QueryTypes.SELECT})
    .then(function(keys) {
        var jenis_kelamin =req.params.jenis_kelamin;
        return sequelize.query("SELECT * FROM '"+TABLE_PREFIX+myTableName+"' WHERE jenis_kelamin = '"+myFieldValue+"' ", { type: sequelize.QueryTypes.SELECT})
    })
    .then(function(rows) {
        if(!rows.length) {
            res.status(404);
            res.json({
                "success" : 0,
                "data" : "No rows found"
            });
        }
        res.status(200);
        res.json({
            "success" : 1,
            "data" : rows
        });
    })
    .catch( function(err) {
        res.status(404);
        res.send({
            "success" : 0,
            "message" : err.message
        });
    });
});

清理功能可确保来自请求的输入不会使您遭受注入攻击或任何其他令人讨厌的意外事件。