Knex Raw Select Postgresql with variable - postgresql

Question

Can I use a variable in a knex query? And what is wrong with db.raw(select usr_vote.vote where usr_vote.user.id = ${loggedInUserId})? Everything else works fine.
In the db.raw that is nowt working, I'm trying to use a variable (loggedInUserId) to get the logged-in users' vote history for the Question (they can upvote / downvote so the value is either -1 or 1 or null). Thanks in advance for any help!
There are 4 tables that look like:
askify_users
id
user_name
askify_questions
id
title
body
tags
date_created
user_id (FK references askify_users.id)
askify_answers
id
answer
question_id (FK references askify_question.id)
user_id (FK references askify_users.id)
askify_question_votes
List item
question_id (FK references askify_questions.id)
user_id (FK references askify_users.id)
vote (-1 or 1)
PRIMARY KEY (question_id, user_id)
getAllQuestions(db, loggedInUserId) {
return db
.from('askify_questions AS q')
.select(
'q.id AS question_id',
'q.title AS question_title',
'q.body AS question_body',
'q.date_created AS date_created',
'q.tags',
db.raw(
`count(DISTINCT ans) AS number_of_answers`
),
db.raw(
`SUM(DISTINCT usr_vote.vote) AS sum_of_votes`
),
db.raw(
`select usr_vote.vote where usr_vote.user_id = ${loggedInUserId}`
),
db.raw(
`json_strip_nulls(
json_build_object(
'user_id', usr.id,
'user_name', usr.user_name,
'full_name', usr.full_name,
'date_created', usr.date_created
)
) AS "user"`
)
)
.leftJoin(
'askify_answers AS ans',
'q.id',
'ans.question_id'
)
.leftJoin(
'askify_users AS usr',
'q.user_id',
'usr.id'
)
.leftJoin(
'askify_question_vote AS usr_vote',
'q.id',
'usr_vote.question_id'
)
.groupBy('q.id', 'usr.id')
},
The query should look as follows. Everything except for 'user_vote_history' is working.
serializeQuestion(question) {
const { user } = question
return {
id: question.question_id,
question_title: xss(question.question_title),
question_body: xss(question.question_body),
date_created: new Date(question.date_created),
number_of_answers: Number(question.number_of_answers) || 0,
user_vote_history: question.user_vote_history,
sum_of_votes: Number(question.sum_of_votes),
tags: xss(question.tags),
user: {
user_id: user.user_id,
user_name: user.user_name,
full_name: user.full_name,
user_vote: user.user_vote,
date_created: new Date(user.date_created)
},
}
},

Answer 1

I note that #felixmosh is correct here regarding bound values, but just to elaborate: the key here is when the string substitution takes place. If you do this:
db.raw(`SELECT vote WHERE user_id = ${loggedInUserId}`)
the substitution takes place in JavaScript, as soon as the JS interpreter reaches this line. The database engine has nothing to do with whatever is in loggedInUserId and neither does Knex: you're essentially bypassing all the built-in protections.
Slightly better is:
db.raw("SELECT vote WHERE user_id = ?", loggedInUserId)
This allows Knex to escape the string in loggedInUserId. If you prefer, you can use a named binding:
db.raw("SELECT vote WHERE user_id = :loggedInUserId", { loggedInUserId })
However, all of this mucking about with bindings is easily avoided by using the facility Knex already provides for subqueries: just put the subquery in a function.
db
.from("askify_questions AS q")
.select(
"q.id AS question_id",
qb => qb.select("usr_vote.vote").where({ user_id: loggedInUserId })
)
.leftJoin(
"askify_question_vote AS usr_vote",
"q.id",
"usr_vote.question_id"
);
The qb parameter stands for "query builder", and is passed by Knex to your function. It behaves very much like your db object.
This generates SQL akin to:
SELECT
"q"."id" AS "question_id",
(
SELECT "usr_vote"."user_id" WHERE "user_id" = ?
)
FROM "askify_questions AS q"
LEFT JOIN "askify_question_vote" AS "usr_vote"
ON "q"."id" = "usr_vote"."question_id"