2017-07-25 45 views
-1

我試圖更改ID爲的用戶的密碼,但我嘗試了一切,但無法正常工作。我打算用這個來管理我的數據庫,通過node.js的用node.js中的mysql查詢更改密碼?

這是我的代碼:

var mysql = require('mysql'); 
var connection = mysql.createConnection({ 
    host: '127.0.0.1', 
    user: 'root', 
    password: 'root', 
    database: 'kitsune', 
    //connectionLimit: 50, 
    port: 3306 }); 

connection.connect(function(err) { 
    if (err) throw err; 
}); 

const iduser = 273; // ID 
const newPassword = "dfgfgSD22"; 

// Change password to uppercased md5 
var insertQuery = "UPDATE `penguins` SET `Password` = UPPER(MD5('" + newPassword + "') WHERE ID = " + iduser + ";" 

connection.query(insertQuery, function(error, results, fields) {; 
    console.log(insertQuery); 
    console.log(JSON.stringify(results)); 
    if (error) throw error; 
}); 
module.exports = connection; 
connection.end(); // End connection 

應該從用戶與MD5大寫ID 更新密碼,但我不斷得到以下錯誤:

Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'WHERE ID = 273' at line 1

查詢該被打印出來:

UPDATE penguins SET Password = UPPER(MD5('dfgfgSD22') WHERE ID = 273;

+4

你缺少一個parenthesi s'「'))WHERE' – Hackerman

+0

**請勿**使用MD5作爲密碼。在**絕對最少**使用像Bcrypt或Scrypt。 – tadman

+2

**警告**:在創建[嚴重SQL之前,您還迫切需要**閱讀[轉義查詢值](https://github.com/mysqljs/mysql#escaping-query-values)注射孔](http://bobby-tables.com/)。對於這裏所有的恐慌抱歉,但如果你不小心,你會創建一個黑客訪問門戶,而不是一個用戶訪問系統。 – tadman

回答

0

你寫

var insertQuery = "UPDATE `penguins` SET `Password` = UPPER(MD5('" + newPassword + "') WHERE ID = " + iduser + ";" 

這裏

`Password` = UPPER(MD5('" + newPassword + "') 

現在只有一個支架關閉

`Password` = UPPER(MD5('" + newPassword + "')) 

替換以下行

var insertQuery = "UPDATE `penguins` SET `Password` = UPPER(MD5('" + newPassword + "')) WHERE ID = " + iduser + ";"