修改SQL参数

@@ -459,7 +459,7 @@ const article = {
     like(req, res, next) {
         const actId = req.body.actId;
         const articleId = req.body.articleId;
-        
+
         let vote = function() {
             req.ctx(ArticleModel).likeArticle(actId, articleId)
                 .then(() => {
@@ -489,14 +489,13 @@ const article = {
 
             // 获取用户IP今日已投票次数
             return req.ctx(ArticleModel).getIpCount(actId, user_ip).then(userCount => {
-                if (userCount.length > 0 && userCount[0].vote_count > vote_limit) {
+                if (userCount.length > 0 && userCount[0].vote_count >= vote_limit) {
                     return Promise.reject({code: 201, message: VOTE_MAX});
                 }
                 if (repeat_limit) {
                     return Promise.resolve();
                 }
                 return req.ctx(ArticleModel).getArticleIp(actId, articleId, user_ip).then(actCount => {
-                    console.log(actCount);
                     if (actCount.length > 0 && actCount[0].vote_count > 0) {
                         return Promise.reject({code: 203, message: VOTE_REPEAT});
                     }

@@ -311,12 +311,16 @@ class ArticleModel extends global.yoho.BaseModel {
      */
     getArticleIp(actId, articleId, ip) {
         let sqlStr = `SELECT COUNT(*) as vote_count 
-                    FROM ACT_ARTICLE_GOOD WHERE act_id = ${actId} 
-                    AND ip = '${ip}' 
-                    AND article_id = ${articleId} 
+                    FROM ACT_ARTICLE_GOOD WHERE act_id = :actId 
+                    AND ip = :ip
+                    AND article_id = :articleId 
                     AND to_days(create_time) = to_days(now())`;
 
-        return mysqlCli.query(sqlStr);
+        return mysqlCli.query(sqlStr, {
+            actId,
+            ip,
+            articleId
+        });
     }
 
     /**
@@ -327,11 +331,14 @@ class ArticleModel extends global.yoho.BaseModel {
      */
     getIpCount(actId, ip) {
         let sqlStr = `SELECT count(*) AS vote_count
-                    FROM ACT_ARTICLE_GOOD WHERE act_id = ${actId} 
-                    AND ip = '${ip}' 
+                    FROM ACT_ARTICLE_GOOD WHERE act_id = :actId 
+                    AND ip = :ip 
                     AND to_days(create_time) = to_days(now())`;
 
-        return mysqlCli.query(sqlStr);
+        return mysqlCli.query(sqlStr, {
+            actId,
+            ip
+        });
     }
 
     /**