import { db } from "../db/database";
type NewPhotoInput = {
title: string;
imageUri: string;
latitude: number | null;
longitude: number | null;
};
export function insertPhoto(input: NewPhotoInput) {
const stmt = db.prepareSync(`
INSERT INTO photos (title, image_uri, latitude, longitude, created_at)
VALUES ($title, $image_uri, $latitude, $longitude, $created_at)
`);
try {
stmt.executeSync({
$title: input.title,
$image_uri: input.imageUri,
$latitude: input.latitude,
$longitude: input.longitude,
$created_at: new Date().toISOString(),
});
} finally {
stmt.finalizeSync();
}
}
Parametrização ($title, $image_uri) evita SQL injection e erro de escape.