MySQL NodeJS prepared statement on INSERTING OR UPDATING table name?

by

Here is the code I am looking to do:

connection.query({
sql: 'CREATE TABLE ? ( `wage` FLOAT NOT NULL , `monday` FLOAT NOT NULL , `tuesday` FLOAT NOT NULL , `wednesday` FLOAT NOT NULL , `thursday` FLOAT NOT NULL , `friday`) ENGINE = InnoDB;',
timeout: 40000, // 40s
},
//[arg1],
function (error, results, fields) {

if (error) {
console.log("Table creation failed");
}else{
console.log("Table creation success");
}

}

);

This does not work as a prepared statement as it takes it and puts it in quotation marks meaning the statement looks like so:

CREATE TABLE 'test' ( `wage` FLOAT NOT NULL , `monday` FLOAT NOT NULL , `tuesday` FLOAT NOT NULL , `wednesday` FLOAT NOT NULL , `thursday` FLOAT NOT NULL , `friday`) ENGINE = InnoDB;

Which is not valid

So instead I am foced to write the statement like this:

connection.query({
sql: 'CREATE TABLE '+arg1+' ( `wage` FLOAT NOT NULL , `monday` FLOAT NOT NULL , `tuesday` FLOAT NOT NULL , `wednesday` FLOAT NOT NULL , `thursday` FLOAT NOT NULL , `friday` FLOAT NOT NULL) ENGINE = InnoDB;',
timeout: 40000, // 40s
},
//[''],
function (error, results, fields) {

if (error) {
console.log("Table creation failed");
}else{
console.log("Table creation success");
}

}

);

This works but it now opens me up to SQL injection which is what I am trying to avoid.

Is there any way I can resolve this and use the prepared statements?

https://www.npmjs.com/package/mysql – This is the package I use

63 thoughts on “MySQL NodeJS prepared statement on INSERTING OR UPDATING table name?”

  22. Pingback: keto diet exercise

  32. Hey I know this is off topic but I was wondering if you knew of any widgets I could add
    to my blog that automatically tweet my newest twitter updates.
    I’ve been looking for a plug-in like this for
    quite some time and was hoping maybe you would
    have some experience with something like this. Please let me know if
    you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

    Reply

  33. Hey! This is my 1st comment here so I just
    wanted to give a quick shout out and tell you I truly
    enjoy reading through your posts. Can you recommend any other blogs/websites/forums that cover the same topics?
    Thanks a lot!

    Reply

  39. Thanks , I’ve recently been searching for info about this topic for
    ages and yours is the best I’ve found out so far. However, what concerning the conclusion? Are you certain in regards
    to the source?

    Reply

  41. I feel this is one of the most important info for me.

    And i’m happy reading your article. However want to statement on few normal
    things, The site taste is great, the articles is
    in point of fact excellent : D. Just right job, cheers

    Reply

  42. Hello there! Do you know if they make any plugins to help with Search Engine Optimization? I’m trying
    to get my blog to rank for some targeted keywords but I’m not seeing very good gains.
    If you know of any please share. Kudos!

    Reply

Leave a Comment