mysql - Does JSON.stringify a string protect against (My)SQL injection? -

i've run across node.js code gets user-supplied string, calls json.stringify(str) , injects value directly sql statement.

e.g.

var x = json.stringify(unsafe_user_string); mysql_execute('update foo set v = ' + x + ' id = 1'); 

obviously abuse of json.stringify, not code , authors see attack vector before patch it. because unsafe_user_string string, not object , escaping of obvious " , \ it's not obvious if there serious problem

is code safe? , if not, demonstrate unsafe input?

thanks!

if sure x string, i'm 99% sure makes impossible conduct sql injection attack. confidence goes down 90% when unsure of type x. said, considering of following should not pose vulnerability:

• null, nan, infinity, -infinity seem come null safe.
• undefined comes value undefined, not string, i'm not sure that. think considered invalid sql rather pose vulnerability.
• date in node.js json.stringify(new date()) returns '"2015-11-09t18:53:46.198z"' you'd want.
• arrays , objects should result in invalid sql although smart conversion enable successful use of sql arrays. said, there might tricky way fill array objects might cause vulnerability, doubt it.
• hex seems convert integer.
• buffers , uint8arrays seem come objects. again, there might way populate object vulnerability, doubt it.