This module provides a method for writing sql queries that is as safe as it possibly can be from SQL injection. It is part of the moped suite of utilities for creating composable configs for building node.js and react apps.
This module is designed to be used in conjunction with
@moped/db-pg, but I intend to make it portable to any other SQL databases supported by moped.
yarn add @moped/sql
const tableName = 'user'const id = 10const query = sql`select * from where id = `
A template string tag which interpolates all values as placeholders unless they are escaped with a function from this package such as
sql`select * from user where id = `
Creates a Postgres identifier. A qualified identifier will be created if more than one name is passed. If a non-string value is used for a name, such as a symbol, a local identifier will be generated.
sql`select * from `// -> 'select * from "user"'sql`select * from `// -> 'select * from "schema"."user"'const fromIdent = Symbolsql`select * from user as `// -> 'select * from user as __local_0__'
Use a string of text directly in the SQL. Helpful if you need to escape the constraints of this library.
Warning: If you use arbitrary user generated input anywhere inside the text you pass to
sql.__dangerous__rawValue, you will have a SQL injection vulnerability. Try not to use
sql.__dangerous__rawValueunless absolutely necessary.
sql`select * from user where id 5`// -> 'select * from user where id = 5'
Joins an array of SQL queries together with an optional seperator. Works similarly to
sql`select from user`// -> 'select id, name from user'