# MySql node, how to escape queries?

**URL:** <https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809>\
**Category:** General\
**Created:** [14 July 2023 07:32 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809 "2023-07-14T07:32:06Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![andre\_x](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@andre\_x](https://discourse.nodered.org/u/andre_x)\
**Post date:** [14 July 2023 07:32 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/1 "2023-07-14T07:32:06Z")

</div>

I'm using the _node-red-node-mysql_, but I need to escape the queries, mainly because the single quotes brakes the queries.  
How can I do that?  
Thanks!

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [14 July 2023 08:17 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/2 "2023-07-14T08:17:12Z")

</div>

Show us an example query you are trying to use.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 July 2023 08:17 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/3 "2023-07-14T08:17:24Z")

</div>

You don't. Use parameters instead (see the nodes readme)

It will save you from a future sequel injection hack 🙂

---

<div class="post-metadata">

**Author:** ![andre\_x](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@andre\_x](https://discourse.nodered.org/u/andre_x)\
**Post date:** [14 July 2023 08:34 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/4 "2023-07-14T08:34:54Z")

</div>

Cool, thanks a lot, in this way the queries are even more readable!  
I'm asking myself why in the [GitHub page](https://github.com/node-red/node-red-nodes) there's this:

> _By it's very nature it allows SQL injection... so be careful out there..._

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 July 2023 08:41 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/5 "2023-07-14T08:41:53Z")

</div>

> [@andre\_x](#):
>
> I'm asking myself why in the [GitHub page](https://github.com/node-red/node-red-nodes) there's this:
> 
> > _By it's very nature it allows SQL injection... so be careful out there..._

That looks outdated.

The real readme is up-to-date and details the use of parameters: [node-red-node-mysql (node) - Node-RED](https://flows.nodered.org/node/node-red-node-mysql)

---

<div class="post-metadata">

**Author:** ![andre\_x](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@andre\_x](https://discourse.nodered.org/u/andre_x)\
**Post date:** [14 July 2023 10:01 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/6 "2023-07-14T10:01:51Z")

</div>

I'm having problem using _LIKE_

```auto
msg.payload.view_as == "master"){
msg.topic = "SELECT * FROM table1 WHERE column1 LIKE '%:view_as%'";

```

I can't seem to place that "view\_as", I always get the variable name and not it's value.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 July 2023 10:08 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/7 "2023-07-14T10:08:39Z")

</div>

Parameters dont have quotes.  
Prepare a variable beforehand and specifiy its name in the query.

```auto
msg.payload.view_as == "master"){
    msg.payload.view = '%' + msg.payload.view_as + '%'
   msg.topic = "SELECT * FROM table1 WHERE (column1 LIKE :view); 

```

---

<div class="post-metadata">

**Author:** ![andre\_x](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@andre\_x](https://discourse.nodered.org/u/andre_x)\
**Post date:** [16 July 2023 11:08 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/8 "2023-07-16T11:08:41Z")

</div>

Thanks!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [30 July 2023 11:09 UTC](https://discourse.nodered.org/t/mysql-node-how-to-escape-queries/79809/9 "2023-07-30T11:09:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.