fix: escape 'key' as reserved word in all MySQL queries with backticks

2026-06-20 23:21:24 +08:00
parent 99fb89c60d
commit 735126ff56
7 changed files with 22 additions and 22 deletions
@@ -23,7 +23,7 @@ func (h *SettingsHandler) GetSettings(c *gin.Context) {
 	}

 	settings := make(map[string]string)
-	rows, err := h.db.Query(`SELECT key, value FROM user_settings WHERE user_id = ?`, user.ID)
+	rows, err := h.db.Query("SELECT `key`, value FROM user_settings WHERE user_id = ?", user.ID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -56,7 +56,7 @@ func (h *SettingsHandler) UpdateSettings(c *gin.Context) {
 		return
 	}
 	for key, val := range body {
-		_, err := tx.Exec(`INSERT INTO user_settings (user_id, key, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)`, user.ID, key, val)
+		_, err := tx.Exec("INSERT INTO user_settings (user_id, `key`, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)", user.ID, key, val)
 		if err != nil {
 			tx.Rollback()
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})