DeveloperandClaude Opus 4.6
98aa39cb1c
- 删除根目录重复的 server.js (830行)，统一使用模块化的 server/index.js - 修复 ESLint 错误: 移除未使用变量、修复 const 声明、处理未使用参数 - 修复 React Hooks 依赖警告: 使用 useCallback 包装函数并添加正确依赖项 - SQL LIKE 查询添加特殊字符转义，防止注入风险 - 移除 CSS 中重复的 @keyframes spin 定义 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
34 lines
909 B
JavaScript
34 lines
909 B
JavaScript
const express = require('express');
|
|
const db = require('../config/database');
|
|
const { authenticate } = require('../middleware/auth');
|
|
const { asyncHandler, AppError } = require('../middleware/errorHandler');
|
|
|
|
const router = express.Router();
|
|
|
|
// 转义 SQL LIKE 特殊字符
|
|
function escapeLikePattern(str) {
|
|
return str.replace(/[%_\\]/g, '\\$&');
|
|
}
|
|
|
|
// 搜索账目
|
|
router.get('/', authenticate, asyncHandler(async (req, res) => {
|
|
const { q } = req.query;
|
|
|
|
if (!q) {
|
|
throw new AppError('请输入搜索关键词', 400, 'MISSING_QUERY');
|
|
}
|
|
|
|
const escapedQ = escapeLikePattern(q);
|
|
const stmt = db.prepare(`
|
|
SELECT * FROM records
|
|
WHERE user_id = ? AND (category LIKE ? ESCAPE '\\' OR note LIKE ? ESCAPE '\\')
|
|
ORDER BY date DESC, id DESC
|
|
LIMIT 50
|
|
`);
|
|
|
|
const records = stmt.all(req.userId, `%${escapedQ}%`, `%${escapedQ}%`);
|
|
res.json(records);
|
|
}));
|
|
|
|
module.exports = router;
|