General node.js data to mysql with stringify & escape - mysql

Question

I need a better understanding about stringify, escape and storing in mysql database. The task looked easy but with escaping I run into some trouble. So I would be happy for general explanation of the following questions:
What I try is to store a javascript object in a mysql DB. It works fine with stringify prior to send. Getting it back from the DB just parse it and everything is fine.
let myObj = {
name: 'Paul',
age: '24'
}
Now, I have additionally a message in my object, which can have special characters:
let myObj = {
name: 'Paul',
age: '24',
message: 'message with special characters: ',`´"~'
}
Also no problem, I started to escape. The result:
let myObj = {
name: 'Paul',
age: '24',
message: 'message with special characters: \'\,\`´\"\~'
}
If I do stringify the object, I get following result:
{
"name": "Paul",
"age": "24",
"message": "message with special characters: \\'\\,\\`´\\\"\\~"
}
Sending it to mysql DB gives following error:
(node:13077) UnhandledPromiseRejectionWarning: Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '\,\`´\"\~"}
Due to the error I manipulated the special characters and removed the additional '\' which gives following result:
obj.message = obj.message(/\\\\/g,'\\');
output:
{
"name": "Paul",
"age": "24",
"message": "message with special characters: \'\,\`´\\"\~"
}
everything is fine and the data is transfered to the DB and my mysql update query has no failure anymore.
Questions:
Is there a better way dealing with escaping inside an object, which will be stringified and send to a mysql DB?
If yes, how is it done? Or is there no other way as to remove the additional backslashes inserted due to the stringify?
One step further. The message has included a new line: \n:
output stringified:
{
"name": "Paul",
"age": "24",
"message": "message with special characters: \'\,\`´\n\\"\~"
}
Sending it to the DB I get following entry (Where \n: I get a new line):
{"name":"Paul","age":"24","message":"message with special characters: ',`´
\"~"}
Which results in an error parsing it back. here is the log (serverside) prior parsing (error makes sense):
{"name":"Paul","age":"24","message":"\',`´\n' +
'\\"~"}
Question:
Regarding the upper part, what do I have to do, to get the \n also escaped? Which means, that the DB entry is correct and the DB doesn't take the \n to start a new line?
Happy for any explaning / help!

Answer 1

I don't know how's the correct way or the easy way, but that's how I did it when I needed to insert a user generated field as a JSON in a MYSQL database
string_cleanJSON_preStringify(str)
{
if(!str.replace) return str;
str=str.replace(/'/g,"\\'"); //escape all at least ' once
str=str.replace(/"/g,'\\"'); //escape all at least " once
str=str.replace(/[\t\r\n\f]/g,''); // remove problematic escape characters
if(str.charAt(str.length-1) == '\\') str+=' '; // add blank space at the end if \ is last character - for example: {"var":"\"} would be problematic
return str;
}
string_cleanJSON_to_query(str)
{
str = str.replace(/(\\)+\\/g,'\\'); // replace all \ more than 1 in a row, to be just 1 ( \\ -> gets escaped again when it's processed to just \)
str = str.replace(/(\\)+"/g,'\\\\\\"'); // replace all \" more than 1 (ex \\\") - i don't know why \\\\\\ - this seem to work in my case, might need to alter based on str manipulations before insert
str = str.replace(/(\\)+'/g,"\\'"); // i don't know why \\ - this seem to work in my case, might need to alter based on str manipulations before insert
str = str.replace(/(\\)+t/g,"t"); // same process as above but with problematic escape characters
str = str.replace(/(\\)+r/g,"r");
str = str.replace(/(\\)+n/g,"n");
str = str.replace(/(\\)+f/g,"f");
return str;
}
How I use this to get a query:
let o = {field_data:string_cleanJSON_preStringify(user_gen_field_data)}
let j = string_cleanJSON_to_query(JSON.stringify(o));
let q = `INSERT INTO blabla (json) VALUES('${j}')`;