Query is working on phpmyadmin but not in express - mysql

Question

I have a problem with a MySQL query, I'm making a controller where I need a filter on the front (React). The controller is made with params inside the route, but is not working when I try to test it with Postman, but if I make the same exact query on phpmyadmin works perfectly.
Controller:
let { tabla, nameUno, fechaIni, fechaFin, nameDos, nameTres, nameCuatro } =
req.params;
conn.query(
// SELECT * FROM tyt_finan WHERE tf_fecha_r BETWEEN '2022-05-31' AND '2022-06-01' AND tf_city IN ('Bogota') AND tf_estado = 'Pendiente' AND tf_campana = 'IN'
"SELECT * FROM " +
tabla +
" WHERE " +
nameUno +
" BETWEEN " +
fechaIni +
" AND " +
fechaFin +
" AND " +
nameDos +
" IN ('') AND " +
nameTres +
" = ? AND " +
nameCuatro +
" = ?",
[req.params.value1, req.params.value2, req.params.value3],
Routes
routes.get(
"/searchAll/:tabla/:nameUno/:fechaIni/:fechaFin/:nameDos/:value1/:nameTres/:value2/:nameCuatro/:value3",
defaultController.searchAll
);
And this is the GET petition that I'm sending on Postman:
http://localhost:9000/searchAll/tyt_finan/tf_fecha_r/'2022-05-31'/'2022-06-01'/tf_city/'Bogota','Barranquilla'/tf_estado/'Pendiente'/tf_campana/'IN'

Answer 1

Use parameters for the variables. It's also easier to use a template literal than concatenation to construct the SQL string with variables for the table and column names.
You also had more values in your parameters array than ? in the SQL. I've replaced IN ('') with = ? to use value1 there.
let {tabla, nameUno, fechaIni, fechaFin, nameDos, value1, nameTres, value2, nameCuatro, value3} = req.params;
conn.query(
`SELECT *
FROM ${tabla}
WHERE ${nameUno} BETWEEN ? AND ?
AND ${nameDos} = ?
AND ${nameTres} = ?
AND ${nameCuatro} = ?`, [fetchaIni, fechaFin, value1, value2, value3], (err, res) => {
if (!err) {
console.log(res);
}
});