INSERT INTO is inserting empty values into mySQL table

Question

I'm trying to make a user registration app with ReactNative, Express.js and mySQL. I have the following code for the login function:

login = () => {

      fetch('http://[myipaddress]/users', {
        method: 'POST',
        headers: {
          'Accept': 'application/json',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          username: this.state.username,
          password: this.state.password,
          insert: false
        })
      })

      .then((response) => response.json())
      .then ((res) => {

        if(res.success === true){
          AsyncStorage.setItem('user', res.user);
          this.props.navigation.navigate('Profile');
        }
        else{
          alert(res.message);
        }

      })
      .done();
  }

The code for signing up is shown below.

userRegister = () =>{

      fetch('http://[myipaddress]/users', {
        method: 'POST',
        headers: {
          'Accept': 'application/json',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          username: this.state.username,
          email: this.state.email,
          password: this.state.password,
          insert: true
        })
      })

      .then((response) => response.json())
      .then((responseJson) => {
        alert(responseJson);
      })
      .catch((error)=>{
        console.error(error);
      });
    }

Finally, here's the insertion code in users.js:

var express = require('express');
var router = express.Router();
var mysql = require('mysql');

var connection = mysql.createConnection({
    host: 'localhost',
    user: 'root',
    password: '',
    database: 'users'
});

router.post('/', function(req, res, next) {

  var username = req.body.username;
  var email = req.body.email;
  var password = req.body.password;
  var insert = req.body.insert;

  console.log(username);
  console.log(email);
  console.log(password);

  if (insert === false) {
      connection.query(
            "SELECT * FROM user WHERE username = ? AND password = ?",
            [username, password], function (err, row, field) {

            if (err) {
                console.log(err);
                res.send({ 'success': false, 'message': 'Could not connect' });
            }

            if (row.length > 0) {
                res.send({ 'success': true, 'user': row[0].username });
            } else {
                res.send({ 'success': false, 'message': 'User not found' });
            }

        });
    } else {
        connection.query(
            "INSERT INTO user(username, email, password) VALUES (username,email,password)", 
            function (err, result) {

            if (err) {
                res.send({ 'success': false, 'message': 'Could not connect' });
            }
            else{
                res.send({ 'success': true, 'message': 'User created' });
            }
        });
    }
});

module.exports = router;

So basically, if insert is false, it means the app is trying to log in and only needs to check if the user exists. This part works fine. However, if insert is true, it should insert the new user information into the table. But for some reason, it's inserting empty values, as such: Screenshot

The first insertion with the username John is what it should look like, I made the insertion manually in phpMyAdmin. The others were insertions made through the app, as you can see all the values are empty. The console logs print out the values just fine, so I know they're being stored in the variables like they should, they're just not being inserted for some reason.

Answer 1

You need to use placeholders in the VALUES list, just like you did in the SELECT query.

    connection.query(
        "INSERT INTO user(username, email, password) VALUES (?, ?, ?)", 
        [username, email, password],
        function (err, result) {