Re: [IBMiOSS] Node-SQL injection

[Mark Murphy <jmarkmurphy@xxxxxxxxx>]

Why does prepare require you to iterate through the result set?

On Mon, Dec 4, 2017 at 1:24 PM, Justin Taylor <JUSTIN@xxxxxxxxxxxxx> wrote:

> I'm working off the documentation here:
> https://www.ibm.com/developerworks/community/
> wikis/home?lang=en#!/wiki/IBM%20i%20Technology%20Updates/
> page/DB2%20for%20i%20Access%20APIs%20-%20New?section=execute
>
> The Basic Query example works fine and returns the entire result set as a
> JS object.  That's all well and good until I need to insert user-input into
> the WHERE clause.  I can't just poke raw user-input into the SQL
> statement.  It looks like I can do parameters with a prepared statement,
> but that requires me to iterate thru the result set (rather than returning
> all at once).
>
> Do I need to use a prepared statement and manually reconstruct the result
> set, or is there a better way?
>
> Thanks
>
>
> --
> This is the IBMi Open Source Roundtable (OpenSource) mailing list
> To post a message email: OpenSource@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/opensource
> or email: OpenSource-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/opensource.