Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
named-placeholders
Advanced tools
The named-placeholders npm package is used to convert SQL query strings with named placeholders into a format that can be used with parameterized queries. This is particularly useful for preventing SQL injection attacks and making SQL queries more readable and maintainable.
Convert named placeholders to positional placeholders
This feature allows you to convert a SQL query with named placeholders into a query with positional placeholders, which can then be executed using a database client that supports parameterized queries.
const named = require('named-placeholders')();
const query = 'SELECT * FROM users WHERE name = :name AND age = :age';
const params = { name: 'John', age: 30 };
const [sql, values] = named(query, params);
console.log(sql); // 'SELECT * FROM users WHERE name = ? AND age = ?'
console.log(values); // ['John', 30]
Support for repeated placeholders
This feature allows you to use the same named placeholder multiple times in a query. The named-placeholders package will correctly replace all instances with the appropriate positional placeholders.
const named = require('named-placeholders')();
const query = 'SELECT * FROM users WHERE name = :name OR nickname = :name';
const params = { name: 'John' };
const [sql, values] = named(query, params);
console.log(sql); // 'SELECT * FROM users WHERE name = ? OR nickname = ?'
console.log(values); // ['John', 'John']
Support for array parameters
This feature allows you to use arrays as parameters in your SQL queries. The named-placeholders package will expand the array into the appropriate number of positional placeholders.
const named = require('named-placeholders')();
const query = 'SELECT * FROM users WHERE id IN (:ids)';
const params = { ids: [1, 2, 3] };
const [sql, values] = named(query, params);
console.log(sql); // 'SELECT * FROM users WHERE id IN (?, ?, ?)'
console.log(values); // [1, 2, 3]
The mysql2 package is a MySQL client for Node.js that supports named placeholders directly in its query method. It provides similar functionality to named-placeholders but is specific to MySQL databases.
The pg-promise package is a PostgreSQL client for Node.js that supports named parameters in queries. It offers similar functionality to named-placeholders but is tailored for PostgreSQL databases.
Sequelize is an ORM for Node.js that supports named replacements in raw SQL queries. It provides a higher-level abstraction for database interactions, including support for named placeholders.
compiles "select foo where foo.id = :bar and foo.baz < :baz" into "select foo where foo.id = ? and foo.baz < ?" + ["bar", "baz"]
npm install named-placeholders
var mysql = require('mysql');
var toUnnamed = require('named-placeholders')();
var q = toUnnamed('select 1+:test', { test: 123});
mysql.createConnection().query(q[0], q[1]);
parser is based on @mscdex code of his excellent node-mariasql library
FAQs
sql named placeholders to unnamed compiler
We found that named-placeholders demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.