Node.js Discord.js环境下如何校验命令参数是否包含数字

功能实现修正方案 #

现有代码问题梳理 #

1. args数组返回的元素本身为字符串类型，不存在.value属性，直接调用校验方法即可
2. 原正则规则仅能排除数字，无法过滤特殊符号、空格等不符合姓名要求的字符
3. 缺少校验失败的用户反馈机制，用户输入不符合规则时无对应提示
4. 原逻辑错误将ID也纳入了无数字校验范围，不符合你仅校验姓名、姓氏的需求
5. 原SQL语句为字符串直接拼接，存在SQL注入安全风险

修正后完整代码 #

const Discord = require('discord.js');
var connection = require('../index.js');

exports.run = (bot, message, args) => {
    var id = args[0];
    var nome = args[1];
    var sobrenome = args[2];

    // 姓名校验正则：仅允许大小写字母，如需支持葡萄牙语带重音字符可替换为 /^[A-Za-zÀ-ÿ]+$/
    const namePattern = /^[A-Za-z]+$/;

    let verificarId = (id) => {
        return new Promise( (resolve, reject) => {
            try {
                connection.query(
                    ' SELECT * FROM `vrp_users` WHERE `id` = ?  ', id,
                    function(err, rows) {
                        if (err) {
                            reject(err)
                        }
                        resolve(rows.length > 0);
                    }
                );
            } catch (err) {
                reject(err);
            }
        });
    };

    let addId = (id) => {
        return new Promise(async (resolve, reject) => {
            let isIdExist = await verificarId(id);
            if (isIdExist) {
                const embed04 = new Discord.MessageEmbed()
                .setColor('#A0EE45')
                .setAuthor('Tuga Academy - Whitelist', 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png')
                .setDescription('Mencione um **ID** que não esteja usado.')
                .setTimestamp()
                .setFooter(`${message.author.username}`, 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png');
                message.channel.bulkDelete(1);
                message.author.send(embed04);
            } else {
                message.member.setNickname(`${id} | ${nome} ${sobrenome}`);
                // 修正SQL注入风险，使用参数化查询
                var sql = "INSERT INTO `vrp_users`(`id`, `whitelisted`, `banned`) VALUES (? ,'1','0')";
                connection.query(sql,[id], function (err, result) {
                    const embed01 = new Discord.MessageEmbed()
                    .setColor('#A0EE45')
                    .setAuthor('Tuga Academy - Whitelist', 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png')
                    .setDescription('ID **autorizado**.')
                    .setTimestamp()
                    .setFooter(`${message.author.username}`, 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png');
                    message.channel.bulkDelete(1);
                    console.log("ID Autorizado: " + id);
                    message.author.send(embed01);
                });
            }
        });
    };

    // 校验逻辑
    if (!id || !nome || !sobrenome) {
        const embedMissing = new Discord.MessageEmbed()
        .setColor('#A0EE45')
        .setAuthor('Tuga Academy - Whitelist', 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png')
        .setDescription('Mencione um **NOME** e **SOBRENOME**.')
        .setTimestamp()
        .setFooter(`${message.author.username}`, 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png');
        message.channel.bulkDelete(1);
        message.author.send(embedMissing);
    } else if (!namePattern.test(nome) || !namePattern.test(sobrenome)) {
        // 姓名格式错误提示，可根据需求替换为对应语言文案
        const embedInvalidName = new Discord.MessageEmbed()
        .setColor('#A0EE45')
        .setAuthor('Tuga Academy - Whitelist', 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png')
        .setDescription('Nome e sobrenome só podem conter letras, sem números ou caracteres especiais.')
        .setTimestamp()
        .setFooter(`${message.author.username}`, 'https://cdn.discordapp.com/attachments/793200558248165396/885579421933776956/logosemfundo96.png');
        message.channel.bulkDelete(1);
        message.author.send(embedInvalidName);
    } else {
        addId(id);
    }
}

内容的提问来源于stack exchange，提问作者Ricardo