prepare requests for staffeurs.controller

back/src/controllers/staffeurs.controller.js

@@ -29,9 +29,10 @@ function getStaffeurs(req, res){
 
 function addNewStaffeur(req, res) {
   var con = mysql.createConnection(dbConfig);
-  var query = "INSERT INTO `Staffeurs` (`login`) VALUES ('"+req.body.login+"');"
+  var query = "INSERT INTO `Staffeurs` (`login`) VALUES (?);"
+  var inserts = [req.body.login];
   con.connect();
-  con.query(query, (err, result) => {
+  con.query(query, inserts, (err, result) => {
     if (err) {
       console.log(err)
       return res.send({ success: false })
@@ -43,9 +44,10 @@ function addNewStaffeur(req, res){
 
 function deleteStaffeur(req, res) {
   var con = mysql.createConnection(dbConfig);
-  var query = "UPDATE Staffeurs SET deleted = 1 WHERE id="+req.body.id+";"
+  var query = "UPDATE Staffeurs SET deleted = 1 WHERE id=?;"
+  var inserts = [req.body.id];
   con.connect();
-  con.query(query, (err, result) => {
+  con.query(query, inserts, (err, result) => {
     if (err) {
       console.log(err)
       return res.send({ success: false })