title: How to simulate SQL injection in NodeJS mysql
body: <p>I am using <code>NodeJS</code> with <code>mysql</code> for working with <code>SQL</code> database.</p>
  
  <p><strong>For school example I want to simulate SQL injection</strong>.</p>
  
  <p>I wrote code with possible <code>SQL injection</code>:</p>
  
  <pre><code>const mysql = require('mysql')
  
  const connection = mysql.createConnection({
      host: settings.DB_MYSQL_HOST,
      user: settings.DB_MYSQL_USER,
      password: settings.DB_MYSQL_PSW,
      database: settings.DB_MYSQL_DB,
  })
  
  let sql = 'DROP TABLE user;'
  connection.query('DELETE FROM todos WHERE id = \'' + sql + '\'', (error) =&gt; {
                  if (error) {
                      res.json({ res: error })
                      console.log('SQL ERROR')
                      console.log(error)
                      throw error
                  }
                  this._sendSucc(res)
  })
  </code></pre>
  
  <p>But <code>SQL injection</code> not working. I want attack to table name 'user'.</p>
  
  <p>Where is a problem? I am not using prepare statement.</p>
  
  <p>Can you give me a example with <code>SQL injection</code></p>