I'm using a lambda function to generate the callback handler for each list page in a group of routes, because the sql is very repetitive for each of these routes. The lambda function uses a callout to a formatter to generate a sql statement.

I wanted to know if anything I'm doing is bad practice or a vulnerability.

function genBrowseListQuery(f, g) {
    return util.format('SELECT %s AS id, ' +
        '%s as name ' +
        'FROM %s ' +
        'ORDER BY %s ASC ' +
        'LIMIT 30 OFFSET $1 * 30', 
        f[0], f[1], g, f[1]);

function prepareBrowseList(groupName, shortName, fields) {
    return (req, res) => {
        var x = [(req.query.page - 1) || 0];
        pool.query(genBrowseListQuery(fields, groupName), x)
        .then((items) => {
            res.render('browse', {
                shortName: shortName,
                thingName: groupName,
                view: 'list',
                items: items.rows

// Then I use it like so.
app.get('/browse/uni', prepareBrowseList('Universes', 'uni',
    ['unv_id', 'unv_name']));

pool is the database connection object.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.