时间戳

首页 > 解决方案 > 登录用户时奇怪的nodejs行为

mysql - 登录用户时奇怪的nodejs行为

问题描述

问题是它显示它在没有重定向代码的情况下成功登录（201），但是使用它，它显示302错误并且email_address未定义。这里可能是什么问题？我仍然无法得出结论。

问题可能是我猜的代码顺序？

const login = async (req, res, next) => {

const { email_address, password, user_email, user_password}: { email_address: string, password: string, user_email: string, user_password: string } = req.body;

try {
  const userWithDetails = 'SELECT * FROM users WHERE email_address = user_email AND password = user_password'; //w form info 
  if (userWithDetails) {
  req.session.loggedin = true; //true
  req.session.email_address = email_address; //undefined
    console.log(req.session.email_address)
  // return res.redirect('./index.html')
}
  res.status(201).send('Succesfully signed in');
    // res.status(403).send('Password is not correct');
} catch(error) {
    res.status(404).send(`User with email ${email_address} not found!`);   
}

  await next;
};

新代码***

const login = async (req, res, next) => {

const { email_address, password}: { email_address: string, password: string} = req.body;

  const userWithDetails = 'SELECT * FROM users WHERE email_address = ?';
  return con.query(userWithDetails, email_address, (err, results) => {
    if (err) {
      console.error(err);
    }
    const user = results.find(emailObj => emailObj.email_address === email_address);
      if (results && results.length && user.email_address) {
        req.session.loggedin = true;
        req.session.email_address = email_address;
        const matchPassword: boolean = bcrypt.compareSync(password, user.password);
        if (matchPassword) {
          const token = jwt.sign({ user }, 'aaaa', { expiresIn: '1h'});
          res.status(200).send({message: 'Logged in', token: token});

        } else {
          res.status(403).send('Password is not correct');
        }

      } else {
        res.status(404).send(`User with email ${email_address} not found!`);   
      } 
});
await next;

}

标签： mysqlnode.jsexpress

解决方案

您不会在任何时候执行您的 sql 查询。

你只是说：

query = 'select blabla'
if(query){...}

当然，这将永远是正确的。您想在您的数据库上运行查询。

同样在您的查询中，您没有正确使用变量，请参阅字符串格式：

let my_var = `SELECT xxx from xxx where username = '${username}'`

还请清理参数以防止 SQL 注入...

推荐阅读