Fix: turn all select statements to prepared queries.

lib/xapi.js

@@ -234,19 +234,18 @@ class Xapi {
   async list(req, res) {
 
     let queryParamsObj = {}
-    queryParamsObj.query = '';
+    queryParamsObj.query = 'select ';
     queryParamsObj.params = [];
-    let cols = ''
 
     if (req.query._groupby) {
-      cols = this.mysql.getColumnsForSelectStmtWithGrpBy(req.query, req.app.locals._tableName);
+      this.mysql.getColumnsForSelectStmtWithGrpBy(req.query, req.app.locals._tableName, queryParamsObj);
     } else {
-      cols = this.mysql.getColumnsForSelectStmt(req.app.locals._tableName, req.query);
+      this.mysql.getColumnsForSelectStmt(req.app.locals._tableName, req.query, queryParamsObj);
     }
 
 
     /**************** tableName ****************/
-    queryParamsObj.query = 'select ' + cols + ' from ?? ';
+    queryParamsObj.query += ' from ?? ';
     queryParamsObj.params.push(req.app.locals._tableName);
 
     /**************** where clause ****************/
@@ -274,18 +273,17 @@ class Xapi {
 
   async nestedList(req, res) {
 
-    let cols = ''
     let queryParamsObj = {}
-    queryParamsObj.query = '';
+    queryParamsObj.query = 'select ';
     queryParamsObj.params = [];
 
     /**************** tableName ****************/
     if (req.query._groupby) {
-      cols = this.mysql.getColumnsForSelectStmtWithGrpBy(req.query, req.app.locals._tableName);
+      this.mysql.getColumnsForSelectStmtWithGrpBy(req.query, req.app.locals._tableName, queryParamsObj);
     } else {
-      cols = this.mysql.getColumnsForSelectStmt(req.app.locals._tableName, req.query);
+      this.mysql.getColumnsForSelectStmt(req.app.locals._tableName, req.query, queryParamsObj);
     }
-    queryParamsObj.query = 'select ' + cols + ' from ?? where ';
+    queryParamsObj.query += ' from ?? where ';
     queryParamsObj.params.push(req.app.locals._childTable);
 
     /**************** where foreign key ****************/

lib/xsql.js

@@ -244,11 +244,23 @@ class Xsql {
     return orderBy
   }
 
-  getColumnsForSelectStmtWithGrpBy(reqQueryParams, tableName) {
+  getColumnsForSelectStmtWithGrpBy(reqQueryParams, tableName, queryParamsObj) {
-    return reqQueryParams._groupby + ',count(1) as _count'
+
+    let grpByCols = reqQueryParams._groupby.split(',');
+
+    for (var i = 0; i < grpByCols.length; ++i) {
+      if (i) {
+        queryParamsObj.query += ','
+      }
+      queryParamsObj.query += ' ??'
+      queryParamsObj.params.push(grpByCols[i])
+    }
+
+    queryParamsObj.query += ',count(1) as _count '
+
   }
 
-  getColumnsForSelectStmt(tableName, reqQueryParams) {
+  getColumnsForSelectStmt(tableName, reqQueryParams, queryParamsObj) {
 
     let table = this.metaDb.tables[tableName];
     let cols = [];
@@ -259,6 +271,7 @@ class Xsql {
     if ('_fields' in reqQueryParams) {
       _fieldsInQuery = reqQueryParams['_fields'].split(',')
     } else {
+      queryParamsObj.query += ' * '
       return " * ";
     }
 
@@ -285,6 +298,14 @@ class Xsql {
 
     }
 
+    for (var i = 0; i < cols.length; ++i) {
+      if (i) {
+        queryParamsObj.query += ','
+      }
+      queryParamsObj.query += '??'
+      queryParamsObj.params.push(cols[i])
+    }
+
     return cols.join(',')
 
   }