SQL injection attack

[huzhenjie]

koa2-note/demo/project/server/models/user-info.js

Line 23 in c667c4f

where email="${options.email}" or name="${options.name}"

The code here will case SQL injection attack.

async getExistOne(options ) {
    let _sql = `
    SELECT * from user_info
      where email="${options.email}" or name="${options.name}" // SQL injection attack
      limit 1`
    let result = await dbUtils.query( _sql )
    if ( Array.isArray(result) && result.length > 0 ) {
      result = result[0]
    } else {
      result = null
    }
    return result
  }

Suggestion

SELECT * from user_info where email=? or name=? limit 1