javascript - 无法使用来自 Node.js 的多个用户定义变量运行 MYSQL 查询

Question

Node.js 代码:

var express    = require("express");
var mysql      = require('mysql');
var connection = mysql.createConnection({
  host     : 'localhost',
  user     : 'root',
  password : 'password',
  database : 'myDatabase'
});
var app = express();

connection.connect(function(err){
if(!err) {
    console.log("Database is connected ... \n\n");
} else {
    console.log("Error connecting database ... \n\n");
}
});

app.get("/",function(req,res){
var tmdb_id, rel_date, role, title, year, starring, actor, categories,choose,use;

choose = 3;
if (choose == 0 || choose == 1 || choose ==2 || choose==3){
use = categories[choose];
connection.query('
SET @tmdbid:= (SELECT TMDB_ID FROM `MOVIES` WHERE VOTES > 2058 ORDER BY RAND() LIMIT 0,1);
SET @genre:= (SELECT GROUP_CONCAT(GENRE_NAME) FROM `MOVIES_GENRES` WHERE TMDB_ID = @tmdbid);
SET @director:=(SELECT GROUP_CONCAT(DISTINCT NAME) FROM`DIRECTORS` WHERE DID IN (SELECT DID FROM `DIRECTS` WHERE TMDB_ID = @tmdbid));
SET @actors:=(SELECT GROUP_CONCAT(DISTINCT NAME) FROM `ACTORS` WHERE AID IN (SELECT AID FROM `ROLES` WHERE TMDB_ID = @tmdbid));
SET @roles:=(SELECT GROUP_CONCAT(DISTINCT CHAR_NAME) FROM `ROLES` WHERE TMDB_ID = @tmdbid);
SET @plot:= (SELECT OVERVIEW FROM `OVERVIEW` WHERE TMDB_ID = @tmdbid);
SELECT TITLE, RELEASE_DATE, @genre, @director, @actors, @roles, @plot
FROM `MOVIES` WHERE TMDB_ID = @tmdbid', function(err,rows,fields){
  console.log(err);
  if (!err){
    console.log(rows[0]);
  }

 else
    console.log('Error while performing Query.');
  });
}


});
app.listen(3000);

查询:

SET @tmdbid:= (SELECT TMDB_ID FROM `MOVIES` WHERE VOTES > 2058 ORDER BY RAND() LIMIT 0,1);
SET @genre:= (SELECT GROUP_CONCAT(GENRE_NAME) FROM `MOVIES_GENRES` WHERE TMDB_ID = @tmdbid);
SET @director:=(SELECT GROUP_CONCAT(DISTINCT NAME) FROM`DIRECTORS` WHERE DID IN (SELECT DID FROM `DIRECTS` WHERE TMDB_ID = @tmdbid));
SET @actors:=(SELECT GROUP_CONCAT(DISTINCT NAME) FROM `ACTORS` WHERE AID IN (SELECT AID FROM `ROLES` WHERE TMDB_ID = @tmdbid));
SET @roles:=(SELECT GROUP_CONCAT(DISTINCT CHAR_NAME) FROM `ROLES` WHERE TMDB_ID = @tmdbid);
SET @plot:= (SELECT OVERVIEW FROM `OVERVIEW` WHERE TMDB_ID = @tmdbid);
SELECT TITLE, RELEASE_DATE, @genre, @director, @actors, @roles, @plot
FROM `MOVIES` WHERE TMDB_ID = @tmdbid

我试图保存所有用户定义的变量值，然后在最后显示它。此代码在使用 MYSQL 工作台 6.3CE 的 MYSQL 5.7 中运行良好。但是当我使用 node.js 运行这段代码时，我无法获得输出，因为它会抛出错误。当我下载 node_modules 时，SQL 的版本在 node 中是 0.9。

错误:

{ [Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SELECT @tmdbid' at line 1]
  code: 'ER_PARSE_ERROR',
  errno: 1064,
  sqlState: '42000',
  index: 0 }

我不确定我哪里出错了。

Answer 1

根据node-mysql documentation没有默认支持在一个查询中使用多个 sql 语句。也许这就是您遇到问题的原因。

在设置初始连接时打开对多个语句的支持:

var connection = mysql.createConnection({
  host     : 'localhost',
  user     : 'root',
  password : 'password',
  database : 'myDatabase',
  multipleStatements: true /* turn on multiple statements */
});

请注意，根据上述文档，这可能会增加 SQL 注入(inject)攻击的风险。

此外，您不能像在query 方法中那样定义字符串。看起来你已经用回车格式化了字符串。令人惊讶的是，在 sql 错误之前，您没有从中得到语法错误。也许您在此处粘贴的代码不是逐字记录的？

无论如何，为了安全起见，我会将整个查询放在一行中。所以你的查询看起来像这样:

connection.query('SET @tmdbid:= (SELECT TMDB_ID FROM `MOVIES` WHERE VOTES > 2058 ORDER BY RAND() LIMIT 0,1); SET @genre:= (SELECT GROUP_CONCAT(GENRE_NAME) FROM `MOVIES_GENRES` WHERE TMDB_ID = @tmdbid); SET @director:=(SELECT GROUP_CONCAT(DISTINCT NAME) FROM `DIRECTORS` WHERE DID IN (SELECT DID FROM `DIRECTS` WHERE TMDB_ID = @tmdbid)); SET @actors:=(SELECT GROUP_CONCAT(DISTINCT NAME) FROM `ACTORS` WHERE AID IN (SELECT AID FROM `ROLES` WHERE TMDB_ID = @tmdbid)); SET @roles:=(SELECT GROUP_CONCAT(DISTINCT CHAR_NAME) FROM `ROLES` WHERE TMDB_ID = @tmdbid); SET @plot:= (SELECT OVERVIEW FROM `OVERVIEW` WHERE TMDB_ID = @tmdbid); SELECT TITLE, RELEASE_DATE, @genre, @director, @actors, @roles, @plot FROM `MOVIES` WHERE TMDB_ID = @tmdbid',

  function (err, rows, fields) {

    if (err)
      console.log(err);
    else
      console.log(rows[0]);

  });
}