如何正确逃避它？

Question

我有 sql 字符串是用模板字符串语法编写的：

const sql = `select * from tbl_name where smth= name like '%%'`;

const data = await execute(sql, [something, someName]);

由于单引号，我在绑定第二个参数 - $2 时遇到问题。应该怎么写才正确？

错误：Error: Query failed: bind message supplies 2 parameters, but prepared statement "" requires 1

Answer 1

我认为你应该这样使用通配符：

const sql = `select * from tbl_name where smth= name like `;
const data = await execute(sql, [something, `%${someName}%`]);

How to escape it properly?