# Pb with SQL and special characters (like ')
**URL:** https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645
**Category:** General
**Created:** [16 March 2023 22:49 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645 "2023-03-16T22:49:55Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Lafayette](https://discourse.nodered.org/u/Lafayette)
#### Post date: [16 March 2023 22:49 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/1 "2023-03-16T22:49:56Z")
Hi,
I have a problem with sql injections in my postgresql database;
Here is the request which works most of the time :
INSERT INTO tdb (tweet, author, date, url, tags) VALUES ('{{{msg.txttweet}}}','{{msg.tweet.user.screen\_name}}','{{msg.tweet.created\_at}}','[https://twitter.com/{{msg.tweet.user.screen\_name}](https://twitter.com/%7B%7Bmsg.tweet.user.screen_name%7D)}/status/{{msg.tweet.id\_str}}','{{msg.hst}}')
I use the {{{}}} to avoid html transformation but sometimes when I have some characters in the tweet ( a string) I have this kind of error message :
- The tweet :
RT @ajaltamimi: New post on publication that appeared not too long ago documenting lives of various male & female 'martyrs' of I…
- The error message :
msg : error "error: syntax error at or near "martyrs""
It seems that the ' character is the problem, and futhermore I don't know why the & is replace by & despite the use of {{{}}}
If you have an idea ...
Thx
---
### Author:  [@UnborN](https://discourse.nodered.org/u/UnborN)
#### Post date: [17 March 2023 00:57 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/2 "2023-03-17T00:57:23Z")
Have you tried using the **Parameterized query** syntax instead of the Template ?
From what i read in this [article](https://stackoverflow.com/questions/58174695/prevent-sql-injection-with-nodejs-and-postgres) it sanitizes the input .. I havent tested it though
Examples in the node's [help site](https://flows.nodered.org/node/node-red-contrib-postgresql)
`INSERT INTO tdb (tweet, author, date, url, tags) VALUES ($txttweet, $author, $date, $url, $tags)`
Function node :
```javascript
msg.queryParameters.txttweet = msg.txttweet;
msg.queryParameters.author = msg.tweet.user.screen_name;
msg.queryParameters.date = msg.tweet.created_at;
msg.queryParameters.url = `https://twitter.com/${msg.tweet.user.screen_name}/status/${msg.tweet.id_str}`
msg.queryParameters.tags= msg.hst;
```
---
### Author:  [@E1cid](https://discourse.nodered.org/u/E1cid)
#### Post date: [17 March 2023 08:36 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/3 "2023-03-17T08:36:35Z")
Or you should be able to escape the `'martyrs'` like this,
`'RT @ajaltamimi: New post on publication that appeared not too long ago documenting lives of various male & female ''martyrs'' of I...'`
So prior to the template add a change node set to
change `msg.``txttweet`
search for `'`
repolace with `''`
---
### Author:  [@Lafayette](https://discourse.nodered.org/u/Lafayette)
#### Post date: [17 March 2023 12:57 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/4 "2023-03-17T12:57:30Z")
Thank you both.
Finally I choose the simple solution : msg.txttweet = txttweet.replace(/'/g, "''").replace(/&/g, "and");
---
### Author:  [@UnborN](https://discourse.nodered.org/u/UnborN)
#### Post date: [17 March 2023 13:07 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/5 "2023-03-17T13:07:23Z")
keep in mind that there could be other symbols that could break your sql query
`--` for example that is used for comments
try it with a test string in `msg.txttweet` to see if it breaks
single quote followed by two dashes
```auto
'--
```
---
### Author:  [@Lafayette](https://discourse.nodered.org/u/Lafayette)
#### Post date: [17 March 2023 13:56 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/6 "2023-03-17T13:56:18Z")
You're right. Thx so much.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [16 May 2023 13:57 UTC](https://discourse.nodered.org/t/pb-with-sql-and-special-characters-like/76645/7 "2023-05-16T13:57:03Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.