@mojojs/sql

Safely generate SQL statements with tagged template literals. Written in TypeScript.

import {sql} from '@mojojs/sql';

// {text: 'SELECT * FROM users WHERE name = $1', values: ['sebastian']}
const {text, values} = sql`SELECT * FROM users WHERE name = ${'sebastian'}`.toQuery();

To prevent SQL injection attacks, all interpolated values become placeholders in the generated query by default. Partial statements can even be used recursively to build more complex queries.

// Use a partial SQL query
const role = 'admin';
const partialQuery = sql`AND role = ${role}`;
const name = 'root';
const {text, values} = sql`SELECT * FROM users WHERE name = ${name} ${partialQuery}`.toQuery();

Make partial statements optional to dynamically generate WHERE clauses.

const partialQuery = foo === true ? sql`AND foo IS NOT NULL` : sql``;
const {text, values} = sql`SELECT * FROM users WHERE name = ${'sebastian'} ${partialQuery}`.toQuery();

And if you need a little more control over the generated SQL query, you can of course also bypass safety features with the tagged template literal sqlUnsafe. But make sure to use whatever escaping functions your database driver supports to escape unsafe values yourself.

import {sql, sqlUnsafe} from '@mojojs/sql';

const role = 'role = ' + escapeLiteral('power user');
const partialQuery = sqlUnsafe`AND ${role}`;
const name = 'root';
const {text, values} = sql`SELECT * FROM users WHERE name = ${name} ${partialQuery}`.toQuery();

Editor Support

• Visual Studio Code

Installation

All you need is Node.js 16.0.0 (or newer).

$ npm install @mojojs/sql

Changelog

v1.0.0 (2022-08-09)

First major release.