Previous: client, Up: SQL Injection in Action [Index]
const Sequelize = require("sequelize");
const sequelize = new Sequelize(
"postgres://docker:docker@127.0.0.1:5432/postgres"
);
sequelize
.authenticate()
.then(() => {
console.log("Connection has been established successfully.");
})
.catch((err) => {
console.error("Unable to connect to the database:", err);
});
module.exports = sequelize;
const sequelize = require("../db");
const Sequelize = require("sequelize");
const Student = sequelize.define(
"student",
{
first_name: {
type: Sequelize.STRING,
allowNull: false,
},
last_name: {
type: Sequelize.STRING,
allowNull: false,
},
id: {
type: Sequelize.INTEGER,
allowNull: false,
primaryKey: true,
},
},
{
timestamps: false,
}
);
module.exports = Student;
const express = require("express");
const Student = require("../models/student");
const router = express.Router();
var pg = require("pg");
const client = new pg.Client({
user: "docker",
database: "postgres",
password: "docker",
port: 5432,
});
client.connect();
router.get("/", async (req, res) => {
try {
const users = await Student.findAll({});
res.json(users);
} catch (error) {
res.status(500).json(error);
}
});
router.post("/add", (req, res) => {
var whitelist = ["first_name", "last_name", "id"];
var data = {};
for (var property in req.body) {
if (
req.body.hasOwnProperty(property) &&
whitelist.indexOf(property) !== -1
) {
data[property] = req.body[property];
}
}
const newStudent = new Student(data);
newStudent
.save()
.then((student) => res.json(student))
.catch((err) => res.status(500).json(err));
});
router.delete("/delete/:id", async (req, res) => {
const idToDel = req.params.id;
console.log(req.params.id);
try {
const success = await Student.destroy({ where: { id: idToDel } });
} catch {
(err) => res.json(500, err);
}
const users = await Student.findAll({});
res.json(users);
});
router.post("/update/:id", (req, res) => {
console.log(
"UPDATE students SET first_name= '" +
req.body.first_name +
"', last_name='" +
req.body.last_name +
"', id='" +
req.body.id +
"' WHERE id='" +
req.params.id +
"';"
);
client.query(
"UPDATE students SET first_name= '" +
req.body.first_name +
"', last_name='" +
req.body.last_name +
"', id='" +
req.body.id +
"' WHERE id='" +
req.params.id +
"';",
(err, result) => {
console.log("Updated");
if (err) {
console.log(err);
}
}
);
});
module.exports = router;