uniapp中plus.sqlite如何防止sql注入。

Question

uniapp中plus.sqlite如何防止sql注入。

function executeSqlCode(sql, sqlParams) {
return new Promise((resolve, reject) => {
plus.sqlite.executeSql({
name: store.state.userInfo.empID,
sql: sql,
params: sqlParams,
success(e) { resolve(e) },
fail(e) { reject(e) }
});
});
}

Answer 1

使用参数化查询，? 占位符被用于用户名和密码，不直接将它们拼接到 SQL 查询字符串中。这样可以避免 SQL 注入攻击

const sql = "SELECT * FROM users WHERE username = ? AND password = ?";
const sqlParams = ["admin", "password123"];
executeSqlCode(sql, sqlParams);