Nodejs使用SQL模糊查询的过程详解

exports.queryWordsList = function (req, res, next) {
  var Words = DB.get('Words')
  var params = req.body
  var page = new Page({
    pageNum: params.pageNum || 1,
    pageSize: params.pageSize || 10,
  })
  delete params.pageNum
  delete params.pageSize
  var sql = `select t.id,t.name,t.words, t.type,t.tip_msg,t.replace_str,t.desc,
    UNIX_TIMESTAMP(t.create_time)*1000 as create_time,
    UNIX_TIMESTAMP(t.modify_time)*1000 as modify_time
    from t_words t`
  if (params.word) {
    sql = `${sql} WHERE name like '%?%' order by t.modify_time desc`
  } else {
    sql = `${sql} order by t.modify_time desc`
  }
  Words.queryPageBySql(sql,page,[params.word],function (err, result) {
      if (err) {
        res.json({ rescode: '10001', err: err })
        return
      }
      var list = page.list
      res.json({ rescode: '10000', data: result })
    }
  )
}

{
    "rescode": "10001",
    "err": {
        "code": "ER_PARSE_ERROR",
        "errno": 1064,
        "sqlMessage": "You have an error in your SQL syntax; check the manual that corresponds to your OceanBase version for the right syntax to use near '其'%' order by t.modify_time desc ) T' at line 4",
        "sqlState": "42000",
        "index": 0,
        "sql": "select count(*) as count from ( select t.id,t.name,t.type,t.tip_msg,t.replace_str,t.desc,\n    UNIX_TIMESTAMP(t.create_time)*1000 as create_time,\n    UNIX_TIMESTAMP(t.modify_time)*1000 as modify_time\n    from t_words t WHERE name like '%'其'%' order by t.modify_time desc ) T"
    },
    "status": false,
    "req_id": "1713148803682.74"
}

exports.queryWordsList = function (req, res, next) {
  var Words = DB.get('Words')
  var params = req.body
  var page = new Page({
    pageNum: params.pageNum || 1,
    pageSize: params.pageSize || 10,
  })
  delete params.pageNum
  delete params.pageSize
  var sql = `select t.id,t.name,t.type,t.tip_msg,t.replace_str,t.desc,
    UNIX_TIMESTAMP(t.create_time)*1000 as create_time,
    UNIX_TIMESTAMP(t.modify_time)*1000 as modify_time
    from t_words t`
  if (params.word) {
    sql = `${sql} WHERE name like ? order by t.modify_time desc`
  } else {
    sql = `${sql} order by t.modify_time desc`
  }
  var queryWord = "%" + params.word + "%";
  Words.queryPageBySql(sql,page,[queryWord],function (err, result) {
      if (err) {
        res.json({ rescode: '10001', err: err })
        return
      }
      var list = page.list
      res.json({ rescode: '10000', data: result })
    }
  )
}

sql = `${sql} WHERE name LIKE ? ESCAPE '\\' ORDER BY t.modify_time DESC`;
var queryWord = "%" + params.word.replace(/\\/g, "\\\\").replace(/%/g, "\\%") + "%";