MySQL NodeJS prepared statement on INSERTING OR UPDATING table name?

by

Here is the code I am looking to do:

connection.query({
sql: 'CREATE TABLE ? ( `wage` FLOAT NOT NULL , `monday` FLOAT NOT NULL , `tuesday` FLOAT NOT NULL , `wednesday` FLOAT NOT NULL , `thursday` FLOAT NOT NULL , `friday`) ENGINE = InnoDB;',
timeout: 40000, // 40s
},
//[arg1],
function (error, results, fields) {

if (error) {
console.log("Table creation failed");
}else{
console.log("Table creation success");
}

}

);

This does not work as a prepared statement as it takes it and puts it in quotation marks meaning the statement looks like so:

CREATE TABLE 'test' ( `wage` FLOAT NOT NULL , `monday` FLOAT NOT NULL , `tuesday` FLOAT NOT NULL , `wednesday` FLOAT NOT NULL , `thursday` FLOAT NOT NULL , `friday`) ENGINE = InnoDB;

Which is not valid

So instead I am foced to write the statement like this:

connection.query({
sql: 'CREATE TABLE '+arg1+' ( `wage` FLOAT NOT NULL , `monday` FLOAT NOT NULL , `tuesday` FLOAT NOT NULL , `wednesday` FLOAT NOT NULL , `thursday` FLOAT NOT NULL , `friday` FLOAT NOT NULL) ENGINE = InnoDB;',
timeout: 40000, // 40s
},
//[''],
function (error, results, fields) {

if (error) {
console.log("Table creation failed");
}else{
console.log("Table creation success");
}

}

);

This works but it now opens me up to SQL injection which is what I am trying to avoid.

Is there any way I can resolve this and use the prepared statements?

https://www.npmjs.com/package/mysql – This is the package I use

63 thoughts on “MySQL NodeJS prepared statement on INSERTING OR UPDATING table name?”

  22. Pingback: keto diet exercise

  32. Hey I know this is off topic but I was wondering if you knew of any widgets I could add
    to my blog that automatically tweet my newest twitter updates.
    I’ve been looking for a plug-in like this for
    quite some time and was hoping maybe you would
    have some experience with something like this. Please let me know if
    you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

    Reply