Applications and operations
Parameterize MySQL queries
Use placeholders for values so input cannot change the structure of a SQL statement.
8 minute lesson
~~~
With mysql2, pass values separately:
const [rows] = await pool.execute(
'SELECT id, title FROM notes WHERE id = ?',
[noteId]
)Placeholders represent values, not table or column names. Choose identifiers from a fixed allowlist when they must vary.
Lesson completed