@@ -16,6 +16,8 @@ $ npm install sqlstring
16
16
17
17
## Usage
18
18
19
+ <!-- eslint-disable no-unused-vars -->
20
+
19
21
``` js
20
22
var SqlString = require (' sqlstring' );
21
23
```
@@ -29,21 +31,27 @@ provided data before using it inside a SQL query. You can do so using the
29
31
``` js
30
32
var userId = ' some user provided value' ;
31
33
var sql = ' SELECT * FROM users WHERE id = ' + SqlString .escape (userId);
34
+ console .log (sql); // SELECT * FROM users WHERE id = 'some user provided value'
32
35
```
33
36
34
37
Alternatively, you can use ` ? ` characters as placeholders for values you would
35
38
like to have escaped like this:
36
39
37
40
``` js
38
- var sql = SqlString .format (' SELECT * FROM users WHERE id = ?' , [userId]);
41
+ var userId = 1 ;
42
+ var sql = SqlString .format (' SELECT * FROM users WHERE id = ?' , [userId]);
43
+ console .log (sql); // SELECT * FROM users WHERE id = 1
39
44
```
40
45
41
46
Multiple placeholders are mapped to values in the same order as passed. For example,
42
47
in the following query ` foo ` equals ` a ` , ` bar ` equals ` b ` , ` baz ` equals ` c ` , and
43
48
` id ` will be ` userId ` :
44
49
45
50
``` js
46
- var sql = SqlString .format (' UPDATE users SET foo = ?, bar = ?, baz = ? WHERE id = ?' , [' a' , ' b' , ' c' , userId]);
51
+ var userId = 1 ;
52
+ var sql = SqlString .format (' UPDATE users SET foo = ?, bar = ?, baz = ? WHERE id = ?' ,
53
+ [' a' , ' b' , ' c' , userId]);
54
+ console .log (sql); // UPDATE users SET foo = 'a', bar = 'b', baz = 'c' WHERE id = 1
47
55
```
48
56
49
57
This looks similar to prepared statements in MySQL, however it really just uses
@@ -96,15 +104,15 @@ provided by a user, you should escape it with `SqlString.escapeId(identifier)` l
96
104
``` js
97
105
var sorter = ' date' ;
98
106
var sql = ' SELECT * FROM posts ORDER BY ' + SqlString .escapeId (sorter);
99
- // -> SELECT * FROM posts ORDER BY `date`
107
+ console . log (sql); // SELECT * FROM posts ORDER BY `date`
100
108
```
101
109
102
110
It also supports adding qualified identifiers. It will escape both parts.
103
111
104
112
``` js
105
113
var sorter = ' date' ;
106
114
var sql = ' SELECT * FROM posts ORDER BY ' + SqlString .escapeId (' posts.' + sorter);
107
- // -> SELECT * FROM posts ORDER BY `posts`.`date`
115
+ console . log (sql); // SELECT * FROM posts ORDER BY `posts`.`date`
108
116
```
109
117
110
118
If you do not want to treat ` . ` as qualified identifiers, you can set the second
@@ -113,7 +121,7 @@ argument to `true` in order to keep the string as a literal identifier:
113
121
``` js
114
122
var sorter = ' date.2' ;
115
123
var sql = ' SELECT * FROM posts ORDER BY ' + connection .escapeId (sorter, true );
116
- // -> SELECT * FROM posts ORDER BY `date.2`
124
+ console . log (sql); // SELECT * FROM posts ORDER BY `date.2`
117
125
```
118
126
119
127
Alternatively, you can use ` ?? ` characters as placeholders for identifiers you would
@@ -135,8 +143,10 @@ You can use `SqlString.format` to prepare a query with multiple insertion points
135
143
utilizing the proper escaping for ids and values. A simple example of this follows:
136
144
137
145
``` js
146
+ var userId = 1 ;
138
147
var inserts = [' users' , ' id' , userId];
139
148
var sql = SqlString .format (' SELECT * FROM ?? WHERE ?? = ?' , inserts);
149
+ console .log (sql); // SELECT * FROM `users` WHERE `id` = 1
140
150
```
141
151
142
152
Following this you then have a valid, escaped query that you can then send to the database safely.
0 commit comments