suppressed possible injection attack; email integration with db.

main.js

@@ -58,7 +58,7 @@ let ncmAPIUrl = "http://localhost:5999";
 
 let currentTask = [];
 
-function Submit(req, res) {
+function Submit(req) {
 
     let uuid = crypto.randomUUID()
 
@@ -140,10 +140,8 @@ function Submit(req, res) {
         onData: callback, onError: errcb
     }).then(() => {
 
-        db.execute(("INSERT INTO instrunet_entry (uuid, song_name, album_name, link_to, databinary, artist,kind, albumcover) VALUES (?,?,?,?,?,?,?,?)"), [uuid, req.body.name, req.body.albumName, req.body.link, fs.readFileSync(kind_of[1]), req.body.artist, req.body.kind, albumCover])
-        db.unprepare(() => {
-
-        })
+        db.execute(("INSERT INTO instrunet_entry (uuid, song_name, album_name, link_to, databinary, artist,kind, albumcover, email) VALUES (?,?,?,?,?,?,?,?,?)"), [uuid, req.body.name, req.body.albumName, req.body.link, fs.readFileSync(kind_of[1]), req.body.artist, req.body.kind, albumCover, req.body.email])
+        db.unprepare()
         fs.rm(kind_of[1], (err) => {
             if (err) {
                 console.log(err);
@@ -205,16 +203,9 @@ app.post('/submit', SubmitWrapper)
 async function SubmitWrapper(req, res) {
     // TODO
     //  May extract logic for dupe check in the future.
-    db.execute(`SELECT uuid, song_name, album_name, artist, kind
-                FROM instrunet_entry
-                WHERE song_name = '${await converters2t.convertPromise(req.body.name)}'
-                  and artist = '${await converters2t.convertPromise(req.body.artist)}'
-                  and kind = ${req.body.kind}`, async (err, rowsT) => {
-        db.execute(`SELECT uuid, song_name, album_name, artist, kind
-                    FROM instrunet_entry
-                    WHERE song_name = '${await convertert2s.convertPromise(req.body.name)}'
-                      and artist = '${await convertert2s.convertPromise(req.body.artist)}'
-                      and kind = ${req.body.kind}`, (err, rowsS) => {
+
+    db.execute(("SELECT uuid, song_name, album_name, artist, kind FROM instrunet_entry WHERE song_name = '?' and artist = '?' and kind = ?"), [await converters2t.convertPromise(req.body.name), await converters2t.convertPromise(req.body.artist), req.body.kind], async (err, rowsT) => {
+        db.execute("SELECT uuid, song_name, album_name, artist, kind FROM instrunet_entry WHERE song_name = '?' and artist = '?' and kind = ?", [await convertert2s.convertPromise(req.body.name), await convertert2s.convertPromise(req.body.artist), req.body.kind],  (err, rowsS) => {
             let dedupe = [];
             rowsT.forEach(row => {
                 dedupe = dedupe.concat(row);
@@ -259,7 +250,7 @@ async function SubmitWrapper(req, res) {
 
 
                 queue.add(() => {
-                    Submit(req, res)
+                    Submit(req)
                 })
                 currentTask.push({
                     name: req.body.name, albumName: req.body.albumName, kind: req.body.kind, artist: req.body.artist,
@@ -282,7 +273,6 @@ async function SubmitWrapper(req, res) {
     })
 
 
-
 }
 
 app.post('/lyric', async (req, res) => {