validate this code, sql injection

[LeandroGazoli]

SELECT ,
(SELECT COUNT() FROM "model_name"
WHERE to_tsvector('english',
coalesce("name", '') || ' ' ||
'X'; DROP TABLE users;--') @@ to_tsquery('english', 'X')
) AS row_count
FROM "model_name"
WHERE to_tsvector('english',
coalesce("name", '') || ' ' ||
'X'; DROP TABLE users;--') @@ to_tsquery('english', 'X')
limit ${options.perPage}
offset ${options.skip};

to

SELECT ,
(SELECT COUNT() FROM "model_name"
WHERE to_tsvector('english',
coalesce(:name, '') || ' ' ||
:searchValue) @@ to_tsquery('english', :searchValue)
) AS row_count
FROM "model_name"
WHERE to_tsvector('english',
coalesce(:name, '') || ' ' ||
:searchValue) @@ to_tsquery('english', :searchValue)
limit :perPage
offset :skip;

[Vladyslav317]

Hi @LeandroGazoli ! I've just checked your code and noticed that you created the same variable data but it isn't used within if condition. Instead, an empty data is used outside of it. Perhaps you intended to assign to the data variable declared outside of the scope.
Additionally, there are some typescript issues in if condition such as Untyped function calls may not accept type arguments. .

Once these issues are fixed, the code now returns the number of matched data instead of data with fields, as it did before. Please take a look and test your code.