@nearform/sql

SQL

A simple SQL injection protection module that allows you to use ES6 template strings for escaped statements. Works with postgres.

1. Install
2. Usage
3. Methods
   1. append
   2. glue
4. How it works?
5. Testing, linting, & coverage
6. Benchmark
7. License

Install

npm install @nearform/sql

Usage

const SQL = require('@nearform/sql')

const db = connectDB() // your db instance

const username = 'user'
const email = '[e-mail]'
const password = 'Password1'

const sql = SQL`INSERT INTO users (username, email, password) VALUES (${username},${email},${password})` // generate SQL query

db.query(sql) // execute query

Methods

append(statement)

const username = 'user1'
const email = '[e-mail]'
const userId = 1

const sql = SQL`UPDATE users SET name = ${username}, email = ${email} `
sql.append(SQL`WHERE id = ${userId}`)

glue(pieces, separator)

const username = 'user1'
const email = '[e-mail]'
const userId = 1

const sql = SQL` UPDATE users SET `

const updates = []
updates.push(SQL`name = ${username}`)
updates.push(SQL`email = ${email}`)

sql.append(sql.glue(updates, ' , '))
sql.append(SQL`WHERE id = ${userId}`)

How it works?

The SQL template string tag parses query and returns an objects that's understandable by postgres:

const username = 'user'
const email = '[e-mail]'
const password = 'Password1'

const sql = SQL`INSERT INTO users (username, email, password) VALUES (${username},${email},${password})` // generate SQL query
sql.text // INSERT INTO users (username, email, password) VALUES ($1 , $2 , $3)
sql.values // ['user, '[e-mail]', 'Password1']

Testing, linting, & coverage

This module can be tested and reported on in a variety of ways...

npm run test            # runs tap based unit test suite.
npm run test:security   # runs sqlmap security tests.
npm run coverage        # generates a coverage report in docs dir.
npm run lint            # lints via standardJS.

Benchmark

Find more about @nearform/sql speed here

License

Copyright nearForm 2018. Licensed under Apache 2.0