Indicate that a placeholder parameter is literal

await dbPool.execute(
  `
    update notifications
    set seen_at = ?
    where id in(?)
  `,
  [
    Date.now(),
    notifications.reduce((accumulator, current) => {
      if (accumulator) accumulator += ',';
      accumulator += `"${current.id}"`;
      return accumulator;
    }, '')
  ]
);

The query does not seem to work and when I try to log the result of the query, it returned:

[
  ResultSetHeader {
    fieldCount: 0,
    affectedRows: 0,
    insertId: 0,
    info: 'Rows matched: 0  Changed: 0  Warnings: 0',
    serverStatus: 2,
    warningStatus: 0,
    changedRows: 0
  },
  undefined
]

BUT, this query works:

await dbPool.execute(
  `
    update notifications
    set seen_at = ?
    where id in(${notifications.reduce((accumulator, current) => {
      if (accumulator) accumulator += ',';
      accumulator += `"${current.id}"`;
      return accumulator;
    }, '')})
  `,
  [
    Date.now()
  ]
);

returning:

[
  ResultSetHeader {
    fieldCount: 0,
    affectedRows: 2,
    insertId: 0,
    info: 'Rows matched: 2  Changed: 2  Warnings: 0',
    serverStatus: 2,
    warningStatus: 0,
    changedRows: 2
  },
  undefined
]

Seems placeholder replacement does not work in this scenario.

Why it happens

I think the reason is because when the placeholder is being replaced, the result becomes:

update notifications
set seen_at = 1574563019209
where id in('"1", "2", "3", "4"')

Notice the single quotes in the IN function, which is not the outcome I am looking for. The correct approach is actually:

const placeholders = notifications.reduce((accumulator) => {
  if (accumulator) accumulator += ',';
  accumulator += '?';
  return accumulator;
}, '');

const result = await dbPool.execute(
  `
    update notifications
    set seen_at = ?
    where id in(${placeholders})
  `,
  [
    Date.now(),
    ...notifications.map(notification => notification.id)
  ]
);

which returns:

[
  ResultSetHeader {
    fieldCount: 0,
    affectedRows: 2,
    insertId: 0,
    info: 'Rows matched: 2  Changed: 2  Warnings: 0',
    serverStatus: 2,
    warningStatus: 0,
    changedRows: 2
  },
  undefined
]

But this is doing more work than it needs it, I just did 2 loops to get to the goal. Is there any way we can tell mysql2 that a parameter is literal where it will not do any parsing to the parameter?

[sidorares]

Yes, this is top level api ( it basically calls sqlstring.format - https://github.com/mysqljs/sqlstring#escaping-query-values )

[sidorares]

in that case .query() is probably better. While .query() and .execute() look similar, the way they work is quite different. See some explanation in https://github.com/sidorares/node-mysql2/issues/196

We should probably be better in helping to notice this, I’ll need to check which type mysql prepare reports for “IN (?)”. Type conversion for execute parameters is based on “what PREPARE returned” vs “what you have in params array”. In your case you have single parameter on PREPARE side - IN (?) and array as parameter to pass, and it was sent as a string