The harm caused by the traditional splicing of SQL

Now let's learn how SQL is injected, and the traditional concatenation of strings will cause

The injection form is the use of "1=1" in the variable, so the query is correct, no matter what.

--VAR sql = "Select name from the person where name= '" +\n 1=1+ "";

　　

Non-recommended wording

var sql = "Select name from the person where name= '" +username+ "";    Connection.query (Sql,function (err,rows,fields) {}

　

Suggested wording

var columns = ' name '; var username = ' Yudi '; var sql = "Select?? From the person where name=? ";    Connection.query (Sql,[columns,username],function (err,rows,fields) {}

The harm caused by the traditional splicing of SQL