2
\$\begingroup\$

I'm using a lambda function to generate the callback handler for each list page in a group of routes, because the sql is very repetitive for each of these routes. The lambda function uses a callout to a formatter to generate a sql statement.

I wanted to know if anything I'm doing is bad practice or a vulnerability.

function genBrowseListQuery(f, g) {
    return util.format('SELECT %s AS id, ' +
        '%s as name ' +
        'FROM %s ' +
        'ORDER BY %s ASC ' +
        'LIMIT 30 OFFSET $1 * 30', 
        f[0], f[1], g, f[1]);
}

function prepareBrowseList(groupName, shortName, fields) {
    return (req, res) => {
        var x = [(req.query.page - 1) || 0];
        pool.query(genBrowseListQuery(fields, groupName), x)
        .then((items) => {
            res.render('browse', {
                shortName: shortName,
                thingName: groupName,
                view: 'list',
                items: items.rows
            })
        });
    }
}

// Then I use it like so.
app.get('/browse/uni', prepareBrowseList('Universes', 'uni',
    ['unv_id', 'unv_name']));

pool is the database connection object.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.