# MSSQL node-red installation problem
**URL:** https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695
**Category:** General
**Created:** [8 July 2020 05:39 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695 "2020-07-08T05:39:47Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@Earl](https://discourse.nodered.org/u/Earl)
#### Post date: [8 July 2020 05:39 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/1 "2020-07-08T05:39:47Z")
Hello, just wanna ask; is the [node-red-contrib-mssql](https://flows.nodered.org/node/node-red-contrib-mssql) still usable? I saw that its last update was more than 3 years ago, and it fails when I tried installing it. Or maybe there's another problem that keeps me from installing the node? I'm quite new to Node-RED, it will make me happy if someone could help. Thanks
---
### Author:  [@Nodi.Rubrum](https://discourse.nodered.org/u/Nodi.Rubrum)
#### Post date: [8 July 2020 14:16 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/2 "2020-07-08T14:16:14Z")
I tried recently to load this module, and short of breaking open the original source of module and tracking down what is wrong, not likely.
> This node uses the **query** operation against the configured database. This does allow both INSERTS and DELETES. By its very nature it allows SQL injection.
Although the newer option, node-red-node-mysql, comments on only insert and update queries, you can craft any SQL statement you want, so I use it for select queries as well. It is current, last update a few months ago, if memory serves.
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [8 July 2020 14:31 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/3 "2020-07-08T14:31:19Z")
mssql != mysql
---
### Author:  [@Nodi.Rubrum](https://discourse.nodered.org/u/Nodi.Rubrum)
#### Post date: [8 July 2020 14:38 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/4 "2020-07-08T14:38:56Z")
Oh, nuts... I did miss read that. Yeah, MS-SQL has some differences in SQL syntax and how it replies to queries. I supported both for years... every time MS would deviate, would drive the developers nuts.
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [8 July 2020 14:55 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/5 "2020-07-08T14:55:51Z")
There are a number of issues with [node-red-contrib-mssql](https://flows.nodered.org/node/node-red-contrib-mssql) use [node-red-contrib-mssql-plus](https://flows.nodered.org/node/node-red-contrib-mssql-plus) instead - most of the bugs have been weeded out and there are tonnes of improvements.
Improvements include...
- Built in help and examples
- Updated dependencies
- Perform multiple queries in one go & get back multiple recordsets (depends on the queries sent)
- Supports stored procedures
- Use env vars in the config node for all fields (including credentials). e.g...
- Server `{{{SQL_IP}}}`
- Password `{{{SQL_PW}}}`
- Use mustache in your SQL queries including msg, flow and global context. e.g...
- `SELECT TOP {{{payload.maxRows}}} * FROM [MyTable] WHERE Name = '{{{flow.name}}}' AND quantity <= {{{global.maxQty}}}`
- View the final query (mustache rendered into values) in `msg.query` to understanding what happened to your {{{mustache}}} parameters
- Choose between throwing an error to the catch node or outputting an error property in `msg.error`
- Additional properties are in the msg object (use a debug node with "complete msg object" set to see whats available)
plus more (hence the `plus` monica)
---
### Author:  [@Nodi.Rubrum](https://discourse.nodered.org/u/Nodi.Rubrum)
#### Post date: [8 July 2020 15:29 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/6 "2020-07-08T15:29:03Z")
Using mustache to avoid potential injection? Plus not in NPM? I don't see updated module in palette install list?
---
### Author:  [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [8 July 2020 15:43 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/7 "2020-07-08T15:43:27Z")
I do
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [8 July 2020 15:49 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/8 "2020-07-08T15:49:42Z")
Who said anything about using mustache to avoid SQL injection?
And as colin points out - it is there!
---
### Author:  [@Nodi.Rubrum](https://discourse.nodered.org/u/Nodi.Rubrum)
#### Post date: [8 July 2020 16:10 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/9 "2020-07-08T16:10:56Z")
I forgot the sarcastic emoji? The plus... I see it now... I must have fat fingered something when I searched.
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [8 July 2020 16:33 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/10 "2020-07-08T16:33:29Z")
So yes, it is possible to cause sql injection if you hook up user settable variables to the mustache parts however, if a user has access to node-red, _irregardless of mustache_, they can just as easily poke a `drop database` into the node - and that goes for any / all xxSQL nodes.
Mustache is for convenience (no sarcasm at all there)
Containment must be made by security and sanity checks on user input.
A future improvement may permit named properties - but as of writing, it does not.
---
### Author:  [@Nodi.Rubrum](https://discourse.nodered.org/u/Nodi.Rubrum)
#### Post date: [8 July 2020 16:41 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/11 "2020-07-08T16:41:22Z")
I am really looking forward to the future improvement. It was not fun avoiding the injection scenario.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [8 July 2020 17:10 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/12 "2020-07-08T17:10:59Z")
Best way to avoid injection is to only use prepared statements. More efficient as well.
---
### Author:  [@Earl](https://discourse.nodered.org/u/Earl)
#### Post date: [13 July 2020 00:00 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/13 "2020-07-13T00:00:27Z")
Hello everyone, thanks for all your reply. I am using Raspberry Pi, it seems my problem was with the incorrect time of my pi, thus having an error with the installation. I thought the problem was with the node itself, I am very sorry for all the trouble. Anyways, thanks for all the help, and thanks @Steve-Mcl for the information regarding the mssql and mssql-plus.
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [15 August 2020 15:28 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/14 "2020-08-15T15:28:50Z")
Parameters and execute mode now supported in mssql-plus V0.5.0
> [@UPDATED: node-red-contrib-mssql-plus 0.5.0](https://discourse.nodered.org/t/updated-node-red-contrib-mssql-plus-0-5-0/31586):
>
> Big update completed, beta tested and now published to NPM. V0.5.0 New Features Parameters It is now possible to include parameters in a query. These can be entered in the updated UI or passed in via msg , flow , global etc. The major benefit of parameters is the protection against SQL Injection attacks Execute mode It is now possible to call native execute method to run stored procedures. This includes the possibility of using TVPs (Table Valued Parameters) Info output Any print or me…
---
### Author:  [@Nodi.Rubrum](https://discourse.nodered.org/u/Nodi.Rubrum)
#### Post date: [16 August 2020 03:54 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/15 "2020-08-16T03:54:10Z")
Yahooooo! Yes, Yes, Yes! .... [Too much?]
---
### Author:  [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [16 August 2020 19:46 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/16 "2020-08-16T19:46:29Z")
> [@Nodi.Rubrum](#):
>
> Too much
Not enough if you ask me 😉
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [30 August 2020 19:46 UTC](https://discourse.nodered.org/t/mssql-node-red-installation-problem/29695/17 "2020-08-30T19:46:40Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.