also looking at this
fix(client)!: bind db.raw and db.sql fragment values or refuse them
#1152
16 files
+455
-118
| @@ -151,8 +151,8 @@ await db.transaction(async (trx) => { | ||
| 151 | 151 | await db |
| 152 | 152 | .updateTable('users') |
| 153 | 153 | .set({ |
| 154 | login_count: sql`login_count + 1`, | |
| 155 | last_login: sql`NOW()` | |
| 154 | login_count: db.raw('login_count + 1'), | |
| 155 | last_login: db.raw('CURRENT_TIMESTAMP') | |
| 156 | 156 | }) |
| 157 | 157 | .where({ id: userId }) |
| 158 | 158 | .execute() |
| @@ -165,7 +165,7 @@ await db | ||
| 165 | 165 | await db |
| 166 | 166 | .updateTable('users') |
| 167 | 167 | .set({ |
| 168 | preferences: sql`JSON_SET(preferences, '$.theme', 'dark')` | |
| 168 | preferences: db.raw("JSON_SET(preferences, '$.theme', 'dark')") | |
| 169 | 169 | }) |
| 170 | 170 | .where({ id: userId }) |
| 171 | 171 | .execute() |