Sql server 带参数的nodejs mssql插入

我是NodeJS的新手，在NodeJS中，我试图插入一个带有参数的表，这样我就可以避免SQL注入，只需转义任何可能导致问题的字符

因此，我目前有一个应用程序，可以插入到数据中而不带参数

以下是我到目前为止的情况：

var fs = require('fs');
var sql = require('mssql');
var LINQ = require("node-linq").LINQ;
const simpleParser = require('mailparser').simpleParser;
var Client = require('yapople').Client;
var client = new Client({
  hostname: 'xxxxxx',
  port:  995,
  tls: true,
  mailparser: true,
  username: 'xxxxx',
  password: 'xxxxx'
});

const config = {
    user: 'xxxxxxx',
    password: 'xxxxx',
    server: 'xxxxx\\',
    port: 'xxxxx'
    database: 'xxxxxx',
    options: {
        instanceName: 'xxxxx'
    }
};

(async function () {
    try {
        let pool = await sql.connect(config)
        
        //Get all current emails
        let emails = await pool.request()
            .query('select uid from email')
        
        //Get uids only
        var uids = new LINQ(emails.recordset)
        .Select(function(email) {return email.uid;})
        .ToArray();

        //Get all emails
        client.connect(function() {
            client.retrieveAll(function(err, messages) {
                messages.forEach(function(message) {
                    //Check if the message exists in our database already.
                    var messageId = message.messageId;

                    var emailExists = new LINQ(uids)
                        .Where(x=>x == messageId).ToArray();

                    //If the message do not exists then add them to the database
                    if(emailExists.length == 0){
                        var sentDate = new Date(message.date).toISOString();
                        var subject = message.subject;
                        var body = message.text;
                        var mailAddress = "";
                        var mailAddressName = "";
                        
                        if(message.from.length > 0){
                            mailAddress = message.from[0].address;
                            mailAddressName = message.from[0].name;
                        }

                       const request = pool.request();
                    request.input('uid', sql.VarChar, messageId);
                    request.input('mail_address', sql.VarChar, mailAddress);
                    request.input('mail_address_display_name', sql.VarChar, mailAddressName);
                    request.input('subject', sql.VarChar, subject);
                    request.input('body', sql.VarChar, body);
                    request.input('sent_date', sql.DateTime, sentDate);
                    request.input('created_by', sql.VarChar, 'system');

                    let result = await request.query('INSERT INTO email(uid, mail_address, mail_address_display_name, subject, body, sent_date, created_by) OUTPUT INSERTED.ID values (@uid, @mail_address, @mail_address_display_name, @subject, @body, @sent_date, @created_by)', (err, result) => {
                        console.dir(result)
                    })

                    }
                });
                client.quit();
            })
        });

    } catch (err) {
        console.log(err);
        // ... error checks
    }
})()

我在看准备好的声明，但我无法让它起作用

下面是我用准备好的语句所尝试的

const ps = new sql.PreparedStatement();

ps.input('uid', TYPES.VarChar);  
ps.input('mail_address', TYPES.VarChar);  
ps.input('mail_address_display_name', TYPES.VarChar);
ps.input('subject', TYPES.VarChar);
ps.input('body', TYPES.VarChar);
ps.input('sent_date', TYPES.DateTime);
ps.input('created_by', TYPES.VarChar);

ps.prepare('INSERT INTO email(uid, mail_address, mail_address_display_name, subject, body, sent_date, created_by) ' +
    ' OUTPUT INSERTED.email_id VALUES (@uid, @mail_address, @mail_address_display_name, @subject, @body, @sent_date, @created_by)', 
    err => {
        ps.execute({
            uid: messageId, 
            mail_address: mailAddress, 
            mail_address_display_name: mailAddressName,
            subject: subject,
            body: body,
            sent_date: sentDate,
            created_by: 'system'
        }, (err, result) => {
            // ... error checks
                                
            ps.unprepare(err => {
                var x =1;
            })
        })
    }
) 

---

您可以使用连接池请求对象添加参数，例如

const request = pool.request()
request.input('myval', sql.VarChar, 'value')
request.query('insert into testtable (somecolumn) values (@myval)', (err, result) => {
    console.dir(result)
})

---

谢谢你的快速回复。sql.VarChar来自何处？您可以让每个查询返回一个承诺，例如request.query，然后在查询完成后使用wait关键字恢复执行。const request=pool.request（）；let result=await request.query（“select*from mytable”）；哦，对不起，是的，它可能不喜欢await关键字吗？调用函数应该标记为异步，例如var callingFunction=async function（）{const request=pool.request（）；let result=await request.query（“select*from mytable”）；console.log（result）；}；callingFunction（）；我想你确实可以，你只需要使用一个更新而不是一个插入。就这么做了。效果很好。