title: How to sanitize inputs in nodejs to prevent sql injection?
body: <p>i have this sanitize function</p>
  <pre><code>    sanitizeXSS: string =&gt; {
        const map = {
            '&amp;': '&amp;amp;',
            '&lt;': '&amp;lt;',
            '&gt;': '&amp;gt;',
            '&quot;': '&amp;quot;',
            &quot;'&quot;: '&amp;#x27;',
            &quot;/&quot;: '&amp;#x2F;',
        };
        const reg = /[&amp;&lt;&gt;&quot;'/]/ig;
        return string.replace(reg, (match)=&gt;(map[match]));
      }
  </code></pre>
  <p>And this sanitize function is being used here</p>
  <pre><code>addOrUpdateAddress : function (request, resolve) 
      {
         
          const customerKey = sanitizeXSS(decrypt_key(request.customer_key));
          const lat = sanitizeXSS(decrypt_key(request.lat));
          const lng = sanitizeXSS(decrypt_key(request.lng));
          const line1 = sanitizeXSS(decrypt_key(request.line1));
          const line2 = sanitizeXSS(decrypt_key(request.line2));
          const city = sanitizeXSS(decrypt_key(request.city));
          const pincode = sanitizeXSS(decrypt_key(request.pincode));
          const state = sanitizeXSS(decrypt_key(request.state));
         
          const contact = sanitizeXSS(decrypt_key(request.contact));
          const landmark = request.landmark?sanitizeXSS(decrypt_key(request.landmark)):null;
          let req=request;
          if(req.name &amp;&amp; req.email)
          {
             
              updateUser(req,function(err,result)
              {
                  console.log(err);
                  console.log(result);
              });
          }
          let addressId = (!req.address_id || req.address_id == null || req.address_id == '')
                  ? -1 : req.address_id;
          console.log(addressId);
          async.auto({
              serviceability : function (cb)
              {
                  searchServiceArea(req,function(err,result)
                  {
                      if(err)
                      {
                          resolve(null, {'errorMessage':'Address selected not serviceble'}, 203, 'error');
                      }
                      else
                      {
                         if(!result.hub_id)
                         {
                            resolve(null, {'errorMessage':'Address selected not serviceble'}, 203, 'error');
                         }
                         if(addressId == -1)
                         {
                             let s=mysql.write('customer_address').insert({customer_key: customerKey,line1:line1,line2:line2,lat: lat,lng: lng,city: city,state: state,pincode: pincode,contact: contact,landmark : landmark,updated_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;),created_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;)}).then(function(res) 
                           
                             {
                              if(res.length &gt; 0)
                              {
                                  cb(null,{address_id:res[0],customer_key: customerKey,line1:line1,line2:line2,lat: lat,lng: lng,city: city,state: state,pincode: pincode,contact: contact,landmark : landmark,updated_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;),created_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;),'hub_id':result.hub_id})
                              }
                              else
                              {
                                  cb(true,{'errorMessage':'Unable to add address try again'})
                              }
  
                             });
                         }
                         else
                         {
                              let s=mysql.write('customer_address').update({line1:line1,line2:line2,lat: lat,lng: lng,city: city,state: state,pincode: pincode,contact: contact,landmark : landmark,updated_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;)}).where({customer_key:customerKey, address_id:addressId}).then(function(res)
                             {
                                  console.log(res)
                                  if(res == 1)
                                  {
                                      cb(null,{address_id:addressId,customer_key: customerKey,line1:line1,line2:line2,lat: lat,lng: lng,city: city,state: state,pincode: pincode,contact: contact,landmark : landmark,updated_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;),created_at:moment().format(&quot;YYYY-MM-DD HH:mm:ss&quot;),'hub_id':result.hub_id})
                                  }
                                  else
                                  {
                                      cb(true,{'errorMessage':'Unable to update address try again'})
                                  }
                           
              },
          },
     );
  
          
      }
  </code></pre>
  <p>So while inserting the address I'm identifying sql injection. I checked everywhere the possible solutions i was not able to solve it. Please do check the sql query also which i have mentioned.
  How to solve this?
  That would be a lot of help. Thanks in advance</p>