mysql-simple-query - npm Package Compare versions

Comparing version 1.0.22 to 1.0.23

lib/mysqlSimpleQuery.js

@@ -228,5 +228,5 @@ const dbQuery = require('./util/dbQuery');
             if (key !== last) {
-                query += `'${value}',`;
+                query += `'${value.toString().replace(/'/g, "\\\'")}',`;
             } else {
-                query += `'${value}'`;
+                query += `'${value.toString().replace(/'/g, "\\\'")}'`;
             }
@@ -233,0 +233,0 @@ });

lib/util/dbQuery.js

@@ -132,3 +132,3 @@ const select = select => {
         const value = data[key];
-        updateData.push(`${key} = "${value}"`);
+        updateData.push(`${key} = "${value.toString().replace(/'/g, "\\'")}"`);
     }
@@ -135,0 +135,0 @@

package.json

 {
   "name": "mysql-simple-query",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Simple query wrapper for mysql-promise to make querying, inserting, updating, and deleting easier for developers.",
@@ -5,0 +5,0 @@ "main": "mysqlSimpleQuery.js",

src/mysqlSimpleQuery.js

@@ -233,5 +233,5 @@ const dbQuery = require('./util/dbQuery');
             {
-                query += `'${value}',`
+                query += `'${value.toString().replace(/'/g, "\\\'")}',`
             } else {
-                query += `'${value}'`
+                query += `'${value.toString().replace(/'/g, "\\\'")}'`
             }
@@ -275,2 +275,2 @@ });
 
-module.exports = mysqlSimpleQuery;
+module.exports = mysqlSimpleQuery;

src/util/dbQuery.js

@@ -141,3 +141,3 @@ const select = (select) => {
         const value = data[key];
-        updateData.push(`${key} = "${value}"`);
+        updateData.push(`${key} = "${value.toString().replace(/'/g, "\\'")}"`);
     }
@@ -161,2 +161,2 @@
     offset
-};
+};

test/mysqlSimpleQueryTest.js

@@ -162,2 +162,14 @@ const expect = require('chai').expect;
 
+    it('insert with single quotes in values', () => {
+        const test = new mysqlSimpleQuery();
+
+        const results = test.insert('product_option_set', {
+            'product_id': "this is a's test",
+            'option_set_uuid': 2222,
+            'datetime': '2019-08-27 03:11:06'
+        }, true);
+
+        expect(results).to.equal("INSERT INTO product_option_set (product_id,option_set_uuid,datetime) VALUES ('this is a\\'s test','2222','2019-08-27 03:11:06');SELECT LAST_INSERT_ID() AS `id`;");
+    });
+
     it('update without where clause', () => {
@@ -223,2 +235,2 @@ const test = new mysqlSimpleQuery();
     });
-});
+});

No alert changes

Improved metrics

Total package byte prevSize

36263

increased by2.01%

Lines of code

916

increased by1.33%

No dependency changes