Needlessly Promiscuous, Modularize!

    @moped/sql
    TypeScript icon, indicating that this package has built-in type declarations

    0.0.7 • Public • Published

    sql

    This module provides a method for writing sql queries that is as safe as it possibly can be from SQL injection. It is part of the moped suite of utilities for creating composable configs for building node.js and react apps.

    This module is designed to be used in conjunction with @moped/db-pg, but I intend to make it portable to any other SQL databases supported by moped.

    Installation

    yarn add @moped/sql
    

    Usage

    import { sql } from 'pg-sql'
     
    const tableName = 'user'
    const id = 10
    const query = sql`select * from ${sql.ident(tableName)} where id = ${id}`

    sql`...`

    A template string tag which interpolates all values as placeholders unless they are escaped with a function from this package such as sql.ident or sql.__dangerous__rawValue.

    Example:

    sql`select * from user where id = ${id}`

    sql.ident(...names)

    Creates a Postgres identifier. A qualified identifier will be created if more than one name is passed. If a non-string value is used for a name, such as a symbol, a local identifier will be generated.

    Examples:

    sql`select * from ${sql.ident('user')}`
    // -> 'select * from "user"'
     
    sql`select * from ${sql.ident('schema', 'user')}`
    // -> 'select * from "schema"."user"'
     
    const fromIdent = Symbol()
     
    sql`select * from user as ${sql.ident(fromIdent)}`
    // -> 'select * from user as __local_0__'

    sql.__dangerous__rawValue(text)

    Use a string of text directly in the SQL. Helpful if you need to escape the constraints of this library.

    Warning: If you use arbitrary user generated input anywhere inside the text you pass to sql.__dangerous__rawValue, you will have a SQL injection vulnerability. Try not to use sql.__dangerous__rawValue unless absolutely necessary.

    Example:

    sql`select * from user where id ${sql.__dangerous__rawValue('=')} 5`
    // -> 'select * from user where id = 5'

    sql.join(queries, seperator?)

    Joins an array of SQL queries together with an optional seperator. Works similarly to Array#join.

    Example:

    sql`select ${sql.join([sql.query`id`, sql.query`name`], '')} from user`
    // -> 'select id, name from user'

    Thanks

    Licence

    MIT

    Keywords

    none

    Install

    npm i @moped/sql

    DownloadsWeekly Downloads

    31

    Version

    0.0.7

    License

    MIT

    Unpacked Size

    25.4 kB

    Total Files

    16

    Last publish

    Collaborators

    • forbeslindesay