Previous: , Up: SQL Injection in Action   [Index]


1.1.4.2 src

const Sequelize = require("sequelize");

const sequelize = new Sequelize(
  "postgres://docker:docker@127.0.0.1:5432/postgres"
);

sequelize
  .authenticate()
  .then(() => {
    console.log("Connection has been established successfully.");
  })
  .catch((err) => {
    console.error("Unable to connect to the database:", err);
  });

module.exports = sequelize;
  1. models
    const sequelize = require("../db");
    const Sequelize = require("sequelize");
    
    const Student = sequelize.define(
      "student",
      {
        first_name: {
          type: Sequelize.STRING,
          allowNull: false,
        },
        last_name: {
          type: Sequelize.STRING,
          allowNull: false,
        },
        id: {
          type: Sequelize.INTEGER,
          allowNull: false,
          primaryKey: true,
        },
      },
      {
        timestamps: false,
      }
    );
    
    module.exports = Student;
    
  2. routes
    const express = require("express");
    const Student = require("../models/student");
    const router = express.Router();
    var pg = require("pg");
    
    const client = new pg.Client({
      user: "docker",
      database: "postgres",
      password: "docker",
      port: 5432,
    });
    client.connect();
    
    router.get("/", async (req, res) => {
      try {
        const users = await Student.findAll({});
        res.json(users);
      } catch (error) {
        res.status(500).json(error);
      }
    });
    
    router.post("/add", (req, res) => {
      var whitelist = ["first_name", "last_name", "id"];
      var data = {};
    
      for (var property in req.body) {
        if (
          req.body.hasOwnProperty(property) &&
          whitelist.indexOf(property) !== -1
        ) {
          data[property] = req.body[property];
        }
      }
      const newStudent = new Student(data);
    
      newStudent
        .save()
        .then((student) => res.json(student))
        .catch((err) => res.status(500).json(err));
    });
    
    router.delete("/delete/:id", async (req, res) => {
      const idToDel = req.params.id;
      console.log(req.params.id);
      try {
        const success = await Student.destroy({ where: { id: idToDel } });
      } catch {
        (err) => res.json(500, err);
      }
      const users = await Student.findAll({});
      res.json(users);
    });
    
    router.post("/update/:id", (req, res) => {
      console.log(
        "UPDATE students SET first_name= '" +
          req.body.first_name +
          "', last_name='" +
          req.body.last_name +
          "', id='" +
          req.body.id +
          "' WHERE id='" +
          req.params.id +
          "';"
      );
      client.query(
        "UPDATE students SET first_name= '" +
          req.body.first_name +
          "', last_name='" +
          req.body.last_name +
          "', id='" +
          req.body.id +
          "' WHERE id='" +
          req.params.id +
          "';",
        (err, result) => {
          console.log("Updated");
          if (err) {
            console.log(err);
          }
        }
      );
    });
    
    module.exports = router;