wunci / koa2-blog Goto Github PK
View Code? Open in Web Editor NEWnode+koa2+mysql
node+koa2+mysql
博主能不能新增在一段时间过后登陆过期,重新登录的功能
router.get('/', async(ctx, next) => {
ctx.redirect('/posts')
})
导致重定向次数过多,删掉正常
请问下 node mysql.js 为什么进程会卡住,表是创建成功了,但是想问下,该进程为什么一直保持运行状态?
A sql injection was discovered in koa2-blog 1.0.0 .There is a sql injection vulnerability which allows remote attackers to Injecting a malicious SQL statement into a server via:
post http://127.0.0.1:3000/signin
Vulnerability code
// 通过名字查找用户
exports.findDataByName = ( name ) => {
let _sql = `select * from users where name="${name}";`
return query( _sql)
}
POC
Trigger SQL injection vulnerability by signin,we can see that the injected statement executed successfully and the page response timed out for 5S
我拉了这个项目有些地方不明白 可以加个微信吗
给我看看吧
// 更新修改文章
exports.updatePost = (values) => {
let _sql = update posts set title=?,content=?,md=? where id=?
return query(_sql,values)
}
我们公司(南昌)需要Node.js人才。
let query = function( sql, values ) {
return new Promise(( resolve, reject ) => {
pool.getConnection(function(err, connection) {
if (err) {
resolve( err )--------->这里为什么不是reject啊
} else {
connection.query(sql, values, ( err, rows) => {
if ( err ) {
reject( err )
} else {
resolve( rows )
}
connection.release()
})
}
})
})
}
我把数据库放到云端,在本地可以正常跑起来,但是貌似同一时间不能让多个用户访问该项目,会报异常
你好,为什么我运行之后,只要输入中文就会报错啊,自己也尝试百度把数据库编码方式改为utf8,这样还是不行
Error: ER_CANT_AGGREGATE_2COLLATIONS: Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (utf8_general_ci,COERCIBLE) for operation '='
at Query.Sequence._packetToError (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\sequences\Sequence.js:47:14)
at Query.ErrorPacket (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\sequences\Query.js:77:18)
at Protocol._parsePacket (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Protocol.js:278:23)
at Parser.write (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Parser.js:76:12)
at Protocol.write (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Protocol.js:38:16)
at Socket. (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:91:28)
at Socket. (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:502:10)
at Socket.emit (events.js:182:13)
at addChunk (_stream_readable.js:283:12)
at readableAddChunk (_stream_readable.js:264:11)
at Socket.Readable.push (_stream_readable.js:219:10)
at TCP.onStreamRead [as onread] (internal/stream_base_commons.js:94:17)
--------------------
at Protocol._enqueue (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Protocol.js:144:48)
at PoolConnection.query (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:200:25)
at pool.getConnection (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\lib\mysql.js:19:20)
at Ping.onOperationComplete (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Pool.js:110:5)
at Ping. (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:502:10)
at Ping._callback (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:468:16)
at Ping.Sequence.end (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\sequences\Sequence.js:83:24)
at Ping.Sequence.OkPacket (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\sequences\Sequence.js:92:8)
at Protocol._parsePacket (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Protocol.js:278:23)
at Parser.write (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Parser.js:76:12)
at Protocol.write (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\protocol\Protocol.js:38:16)
at Socket. (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:91:28)
at Socket. (C:\Users\Administrator\Desktop\文件dsd\Koa2-blog-master\node_modules\mysql\lib\Connection.js:502:10)
at Socket.emit (events.js:182:13)
at addChunk (_stream_readable.js:283:12)
at readableAddChunk (_stream_readable.js:264:11)
非常不错的教程,学习了,已star。
按照教程文档一步一步下来,文档中有几个小错误,但是参考了源码后都很容易解决:
1.在“实现注册页面”那里,有一个拼写错误,singup.js,实际上应该是signup.js 。
2.在“发表文章”那里,代码 router.get('/posts/:postId'...,代码贴少了,没有处理评论的相关内容。
3.删除评论时,删除某一条时,会将这一条以及之后的所有评论删除。源码中没有这个问题。
4.安装supervisor时,要么通过-g来安装,要么就通过在package.json中加script来做。
不好意思,看错了
你好,我是个初学者,我看了你的代码有些不是很懂,为什么密码是在服务器登录验证时加密,而不是在前端加密,前端发送的是明文密码,这样子在后端加密有什么作用?
koa2-cors完全没有用,请问你有遇到过吗?
你可以看一下 mysql中的session 被我写入了一个helloworld
POST地址:
http://blog.wclimb.site/posts/2/edit
参数:
{"id":"2","title":"hahah","content":"asdasdasdas"}
Header:
Content-Type: application/json
返回true
修改成功!
delete from posts where id = ${id}; delete from article where postsId = ${id};
数据库执行没问题
let deleteArticle = function(id){
console.log(id)
let _sql =delete from posts where id = ${id}; delete from article where postsId = ${id};
return query(_sql)
}
ER_PARSE_ERROR: You have an error in your SQL syntax; check
the manual that corresponds to your MySQL server version for the right syntax t
o use near 'delete from posts where folderId = 41' at line 2
`else {
connection.query(sql, values, ( err, rows) => {
if ( err ) {
reject( err )
} else {
resolve( rows )
}
connection.release()
})`这是你的mysql.js中的一段代码其中connection.release()看起来永远也不会执行
A sql injection was discovered in koa2-blog 1.0.0 .There is a sql injection vulnerability which allows remote attackers to Injecting a malicious SQL statement into a server via:
post http://127.0.0.1:3000/signup
Vulnerability code
// 通过名字查找用户数量判断是否已经存在
exports.findDataCountByName = ( name ) => {
let _sql = `select count(*) as count from users where name="${name}";`
return query( _sql)
}
}
POC
Trigger SQL injection vulnerability by registering new users,we can see that the injected statement executed successfully and the page response timed out for 7S
想问一下,我发布文章的时候,发布成功之后,标题和内容里面的汉字都会变成“????”这个,不知道什么原因
server is running at http://localhost:3000
(node:14693) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 1): Error: ER_NOT_SUPPORTED_AUTH_MODE: Client does not support authentication protocol requested by server; consider upgrading MySQL client
(node:14693) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
像是sql的客户端不支持
我不知道为什么,我和你一摸一样的方法,比如发表文章这个接口,我点击发表按钮,接口那里打印
var postData = ctx.request.body
console.log('/create', postData)
像这样的打印,会打印两遍,会导致我的页面没法跳转到所有文章的列表页,我很苦恼,不知道什么原因,之前登录还是注册好像也是这样,求救!!!!!
如果你的开发环境跟上线环境,你是怎么切换的,手动?
如题!
我的macos的默认端口不是3306,还是把port加上去吧,免得其他人走弯路。
site域名套路云你怎么备案的?现在貌似不受理了
博主,我想问一下,koa-blog中的发表文章功能标题和内容有字数限制吗?
程序中断报错:Handshake inactivity timeout
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.