ER_PARSE_ERROR error in my discord.js xp bot

Question

I just got an error called "ER_PARSE_ERROR" while i was trying to create a discord.js bot for XP. Can someone helps me? Here is my code :

    var con = mysql.createConnection({
  host: "127.0.0.1",
  user: "root",
  password: "",
  database: "sadb"
});

function generatedXp() {
  let min = 20;
  let max = 30;

  return Math.floor(Math.random() * (max - min + 1)) + min;
}

con.connect(err => {
  if(err) throw err;
  console.log("Connected to database!");
});

client.on("message", async message => {
  if(message.author.bot) return;
  if(message.channel.type === "dm") return;

  con.query(`SELECT $ FRM xp WHERE id = '` + message.author.id + `'`, (err, rows) => {
    if(err) throw err;

    let sql;

    if(rows.length < 1) {
      sql = `INSERT INT xp (id, xp) VALUES ('${message.author.id}', ${generatedXp()})`;

    } else{
      let xp = rows[0].xp;
      sql = `UPDATE xp SET xp = ${xp + generatedXp()} WHERE id = '${message.author.id}'`;
    }

    con.query(sql, console.log);
  });

  if(/(?:http?:\/)?discord(?:app.com\/invite|.gg)/gi.test(message.content)) {
    message.delete();
    return;
  }

  let messageArray = message.content.split(/\s+/g);
  let command = messageArray[0];
  let args = messageArray.slice(1);

  if(!command.startsWith(prefix)) return;

  let limit = client.ratelimits.get(message.author.id);
  let now = Date.now()
  let timeLimit = 2000;

  if(limit != null) {
    if(limit >= now - timeLimit) {
      message.delete()
      return message.channel.send("Vous venez de vous faire ratelimited. Essayez dans `" + (Math.abs((now - limit) - timeLimit) / 1000).toFixed(2) + "` seconds").then(m => m.delete(2000));

    }else{
      client.ratelimits.set(message.author.id, now);
    }
  }else{
    client.ratelimits.set(message.author.id, now);
  }

  let cmd = client.command.get(command.slice(prefix.length));
  if(cmd) cmd.run(client, message, args, con);
});

The error i just got before:

ER_PARSE_ERROR: Syntax error 'xp WHERE id = '649196303137505298'' at lign 1
    at Query.Sequence._packetToError (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\sequences\Sequence.js:47:14)
    at Query.ErrorPacket (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\sequences\Query.js:79:18)
    at Protocol._parsePacket (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\Protocol.js:291:23)
    at Parser._parsePacket (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\Parser.js:433:10)
    at Parser.write (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\Parser.js:43:10)
    at Protocol.write (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\Protocol.js:38:16)
    at Socket.<anonymous> (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\Connection.js:88:28)
    at Socket.<anonymous> (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\Connection.js:526:10)
    at Socket.emit (events.js:210:5)
    at addChunk (_stream_readable.js:309:12)
    --------------------
    at Protocol._enqueue (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\protocol\Protocol.js:144:48)
    at Connection.query (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\mysql\lib\Connection.js:198:25)
    at Client.<anonymous> (c:\Users\user\Desktop\BotDiscord\Discord Bot\index.js:45:7)
    at Client.emit (events.js:215:7)
    at MessageCreateHandler.handle (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\discord.js\src\client\websocket\packets\handlers\MessageCreate.js:9:34)
    at WebSocketPacketManager.handle (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\discord.js\src\client\websocket\packets\WebSocketPacketManager.js:105:65)
    at WebSocketConnection.onPacket (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\discord.js\src\client\websocket\WebSocketConnection.js:333:35)
    at WebSocketConnection.onMessage (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\discord.js\src\client\websocket\WebSocketConnection.js:296:17)
    at WebSocket.onMessage (c:\Users\user\Desktop\BotDiscord\Discord Bot\node_modules\ws\lib\event-target.js:120:16)
    at WebSocket.emit (events.js:210:5)

Please, i REALLY need help ;-; , i tried to fix it but i didn't find any syntax error in the code...

(and sorry for my really bad english, i am french)

Answer 1

Use placeholder values, like that :

con.query('SELECT $ FRM xp WHERE id = ?', [message.author.id], (err, rows) => {
...
});

By doing that, your request will be escaped (no really need with an id, but you are never too careful and the mysql module will do everything well on the syntax part.