Giorgia Mazzini
05/23/2022, 1:55 PMThat's the error I get: :sob:{
"errors": [
{
"message": "\nInvalid `prisma.queryRaw()` invocation:\n\n\n Raw query failed. Code: `42601`. Message: `db error: ERROR: syntax error at or near \"$1\"`",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"getCars"
],
"extensions": {
"code": "INTERNAL_SERVER_ERROR",
"exception": {
"code": "P2010",
"clientVersion": "3.13.0",
"meta": {
"code": "42601",
"message": "db error: ERROR: syntax error at or near \"$1\""
},
"stacktrace": [
"Error: ",
"Invalid `prisma.queryRaw()` invocation:",
"",
"",
" Raw query failed. Code: `42601`. Message: `db error: ERROR: syntax error at or near \"$1\"`",
" at Object.request (C:\\Users\\Giorgia.Mazzini\\Documents\\learninggraphql\\smarter01\\BE\\node_modules\\@prisma\\client\\runtime\\index.js:45629:15)",
" at async Proxy._request (C:\\Users\\Giorgia.Mazzini\\Documents\\learninggraphql\\smarter01\\BE\\node_modules\\@prisma\\client\\runtime\\index.js:46456:18)"
]
}
}
}
],
"data": {
"getCars": null
}
}
That's my code
getCars: (_parent, { input }, { prisma }) => {
if(input){
console.log(input) // --> SELECT * FROM car WHERE car."plate" ILIKE '%123%' //type String
const differentInput = '%123%'
// const result = prisma.$queryRaw`SELECT * FROM car WHERE car."plate" ILIKE '%123%'` // works
// const result = prisma.$queryRaw`SELECT * FROM car WHERE car."plate" ILIKE ${differentInput}` // works
// const result = prisma.$queryRawUnsafe(input) // Works
const result = prisma.$queryRaw`${input}` // Doesn`t work!!!!
return result
}
// ... Other code
}
Jason Kleinberg
05/23/2022, 4:52 PMprisma.queryRaw
is intended to run using the templated string function. prisma.queryRawUnsafe
uses a different method of protecting against SQL injection.
https://www.prisma.io/docs/concepts/components/prisma-client/raw-database-access#queryrawJason Kleinberg
05/23/2022, 4:57 PMprisma.queryRawUnsafe
. Note that despite the name, if you are using it correctly (with `$#`/`?` for your fields, and a matching list of fields, it does protect you from SQL injection.