Error in SQL syntax [function in node-red]

I’m trying to post the data into database through node-red but I got this error.

“Error: ER_PARSE_ERROR: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘insert into customizations(custom_id, product_id, paper_id, ribbon_id, custom_qt’ at line 1”

This is the function I used.

var items    = msg.payload.items;
var sql = "";
var template = "insert into customizations(custom_id, product_id, paper_id, ribbon_id, custom_qty, message)";
template    += " values(null,'c1','c2','c3','c4','c5')";

for(var i=0;i<items.length;i++){
var cp = template;
cp = cp.replace('c1',items[i].autoId);
cp = cp.replace('c2',items[i].paper_id);
cp = cp.replace('c3',items[i].ribbon_id);
cp = cp.replace('c2',items[i].qty);
cp = cp.replace('c3',items[i].message);
sql += cp;
}


msg.topic = sql;
return msg;

Answer

1. It’s extremely bad habit to use replace or any string operations to insert values to your SQL. Read your manual to learn how to PREPARE statement once and then execute the prepared statement inside your loop.
2. You have mixed c2, c3, c4 and c5 in replace section.
3. Your syntax error is that SQL statements should end with semicolon (;)