产品推荐

center-app/app/base/service/impl/dbproduct/productSve.js

@@ -211,27 +211,38 @@ class ProductService extends ServiceBase {
   async getProductRecommend(actionBody,appInfo){
     const type = actionBody.type;
     let sql=``;
-    let result = ''
+    let paramsWhere ={};
     if(type ==1 ){
-      sql = `select DISTINCT(recommend_code) from p_company_recommend where company_name = '${actionBody.companyName}'`;
+      sql = `select DISTINCT(recommend_code) from p_company_recommend where company_name = :companyName`;
+      paramsWhere['companyName'] = actionBody.companyName;
     }
     if(type ==2 ){
-      sql = `select DISTINCT(recommend_code) from p_company_recommend where company_name = '${actionBody.companyName}' and product_code = '${actionBody.productCode}'`;
+      sql = `select DISTINCT(recommend_code) from p_company_recommend where company_name = :companyName and product_code = :productCode`;
+      paramsWhere['companyName'] = actionBody.companyName;
+      paramsWhere['productCode'] = actionBody.productCode;
     }
     if(type ==3 ){
-      sql = `select DISTINCT(recommend_code) from p_product_recommend where product_code = '${actionBody.productCode}'`;
+      sql = `select DISTINCT(recommend_code) from p_product_recommend where product_code = :productCode`;
+      paramsWhere['productCode'] = actionBody.productCode;
     }
-    result = await this.customQuery(sql);
+    let result = await this.customQuery(sql,paramsWhere);
     if(result.length==0){
       return system.getResultFail(-1,'暂无配置数据')
     }
-    let codes = "";
+    let codes = [];
     result.forEach(item =>{
-      codes += "'"+item.recommend_code+"',";
+      if(item.recommend_code){
+        codes.push(item.recommend_code)
+      }
     })
-    codes = codes.substring(0,codes.length-1);
-    let productSql = `select * from v_product where channel_item_code in (${codes}) and uapp_id = ${appInfo.uapp_id}`
-    let rtn = await this.customQuery(productSql);
+    paramsWhere ={};
+    let productSql = `select * from v_product where channel_item_code in (:codes) and uapp_id = :uapp_id`
+    paramsWhere['uapp_id'] = appInfo.uapp_id;
+    let rtn={};
+    if(codes.length>0){
+      paramsWhere['codes'] = codes;
+      rtn = await this.customQuery(productSql,paramsWhere);
+    }
     return system.getResult(rtn);
   }
 }