title: MySQL transaction versus spam
body: <p>I want a user to have a maximum of 3 entries in a table, I thought I'd need to use a transaction for this case to prevent any harmful spamming that might pass the 3 entry check. That's what I did and was left with the following code; a simplified version that removes all non-needed stuffs;</p>
  
  <pre><code>database.pool.getConnection(function(err, connection){
        if(err) return reject(err);
  
        connection.query(`SELECT COUNT(*) as total FROM addresses WHERE uid = ${ database.pool.escape(uid) } AND status = 1 AND method = ${ database.pool.escape(method) } FOR UPDATE`, async function(err, result) {
          if(err){
            connection.rollback();
            return reject(err);
          } 
          if(result[0].total &gt;= 3) return reject(`You have reached the max.`);
  
          try {
            var adress_obj = await get_address_here();
            connection.query(`INSERT INTO addresses SET label = ${ database.pool.escape(label) },
              method = ${ database.pool.escape(method) },
              wallet_address = ${ database.pool.escape(adress_obj.address) },
              address = ${ database.pool.escape(address) },
              uid = ${ database.pool.escape(uid) }`, function(err){
  
              if(err){
                connection.rollback();
                return reject(err);
              } 
  
              connection.commit(function(err){
                if(err){
                  connection.rollback();
                  return reject(err);
                }
  
                // Completed transaction, resolve promise
                resolve();
              });
            });
          } catch(err) {
            reject(err);
          }
        });
      });
  </code></pre>
  
  <p>Alright, now what happens, is nothing really.. it doesn't differ from just calling two queries.. when a user spam clicks he is able to get through like 10 database entries when the maximum really should be 3.. what am I missing, do I even need to use a transaction for this? <code>FOR UPDATE</code> seemed to be needed for my purpose but I don't see it working either.</p>
  
  <p>Also, the entries in the database are fine.. all that's wrong is that the transaction doesn't seem to work and is not preventing a spam action by users.</p>