Escape invalid Date objects as NULL

AdriVanHoudt · dougwilson · commit d6845127c42b · 2016-11-01T11:52:02.000-04:00
closes #10
diff --git a/HISTORY.md b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Escape invalid `Date` objects as `NULL`
+
 2.1.0 / 2016-09-26
 ==================
 
diff --git a/lib/SqlString.js b/lib/SqlString.js
@@ -40,19 +40,18 @@ SqlString.escape = function escape(val, stringifyObjects, timeZone) {
     case 'number': return val+'';
     case 'object':
       if (val instanceof Date) {
-        val = SqlString.dateToString(val, timeZone || 'local');
+        return SqlString.dateToString(val, timeZone || 'local');
       } else if (Array.isArray(val)) {
         return SqlString.arrayToList(val, timeZone);
       } else if (Buffer.isBuffer(val)) {
         return SqlString.bufferToString(val);
       } else if (stringifyObjects) {
-        val = val.toString();
+        return escapeString(val.toString());
       } else {
         return SqlString.objectToValues(val, timeZone);
       }
+    default: return escapeString(val);
   }
-
-  return escapeString(val);
 };
 
 SqlString.arrayToList = function arrayToList(array, timeZone) {
@@ -111,6 +110,10 @@ SqlString.format = function format(sql, values, stringifyObjects, timeZone) {
 SqlString.dateToString = function dateToString(date, timeZone) {
   var dt = new Date(date);
 
+  if (isNaN(dt.getTime())) {
+    return 'NULL';
+  }
+
   var year;
   var month;
   var day;
@@ -144,9 +147,11 @@ SqlString.dateToString = function dateToString(date, timeZone) {
   }
 
   // YYYY-MM-DD HH:mm:ss.mmm
-  return zeroPad(year, 4) + '-' + zeroPad(month, 2) + '-' + zeroPad(day, 2) + ' ' +
+  var str = zeroPad(year, 4) + '-' + zeroPad(month, 2) + '-' + zeroPad(day, 2) + ' ' +
     zeroPad(hour, 2) + ':' + zeroPad(minute, 2) + ':' + zeroPad(second, 2) + '.' +
     zeroPad(millisecond, 3);
+
+  return escapeString(str);
 };
 
 SqlString.bufferToString = function bufferToString(buffer) {
diff --git a/test/unit/test-SqlString.js b/test/unit/test-SqlString.js
@@ -173,6 +173,13 @@ test('SqlString.escape', {
     assert.strictEqual(string, expected);
   },
 
+  'invalid dates are converted to null': function() {
+    var date   = new Date(NaN);
+    var string = SqlString.escape(date);
+
+    assert.strictEqual(string, 'NULL');
+  },
+
   'buffers are converted to hex': function() {
     var buffer = new Buffer([0, 1, 254, 255]);
     var string = SqlString.escape(buffer);
