쿼리를 실행하는 동안 sql 구문 오류가 발생했습니다 (sql injection)?

Question

QUERY :

model.client.query("SELECT (6371 * acos(cos(radians(:latitude)) * cos(radians(latitude)) * cos(radians(longitude) - radians(:longitude)) + sin(radians(:latitude)) * sin(radians(latitude)))) AS distance FROM offers where isActive= :isActive ",{'latitude': latitude, 'longitude': longitude,'isActive':1},function (err,rows) { 
     console.log(err); 
}); 

오류는

{ Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ':latitude)) * cos(radians(latitude)) * cos(radians(longitude) - radians(:' at line 1 

Answer 1

model.client.query("SELECT (6371 * acos(cos(radians(?)) * cos(radians(latitude)) * cos(radians(longitude) - radians(?)) + sin(radians(?)) * sin(radians(latitude)))) AS distance FROM offers where isActive= ? ",[latitude,longitude,latitude,isActive],function (err,rows) { 
     console.log(err); 
});