Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Yet another SQL query builder.
There are many sql query builders out there. But this one makes more sense to me :wink:.
npm install --save sqlify
This package is a wrapper around squel module to make it more friendly. (Check that package to know its maintenance status)
Helps you to build dynamic sql queries.
Example use case: suppose, you are getting a POST request to insert some data to your SQL database.
You'll get the data in req.body
as {name: "Swat", age: 22, address: "ND"}
.
Now make the query like:
const resource = {
set: req.body
where: {
id: 5
}
}
sqlify(chain, resource); // done!
Warning ⚠️: Do not ever pass queries generated on the client side to your web server for execution. The above example is only a use case. Do NOT copy paste as such.
const { squel, sqlify } = require('sqlify');
const resource = {
field: ['name', 'age', 'address'],
where: {
name: 'Swat',
age: 22,
},
};
const chain = squel.select().from('users');
sqlify(chain, resource);
chain.toString();
// => SELECT name, age, address FROM users WHERE (name=Swat) AND (age=22)
import { squel, sqlify, Resource } from 'sqlify'
// `Resource` is type.
const resource :Resource = {
field: ['name', 'age', 'address'],
where: {
name: 'Swat',
age: 22,
},
};
// ...
// ...
const resource = {
field: ['user.*', 'hobbies.hobby', 'colors.favorite'],
where: {
name: 'Swat',
age: 22,
},
join: [
['hobbies', null, 'hobbies.id = user.id'],
['colors', null, 'colors.user_id = user.id'],
];
}
const chain = squel.select().from('Hero');
sqlify(chain, resource);
chain.toString();
/*
SELECT
user.*,
hobbies.hobby,
colors.favorite
FROM Hero
INNER JOIN hobbies
ON (hobbies.id = user.id)
INNER JOIN colors
ON (colors.user_id = user.id)
WHERE (name='Swat') AND (age=22)
*/
Read the JOIN section of squel docs for more.
const { squel, sqlify } = require('sqlify');
const resource = {
set: {
name: 'Swat',
age: 22,
},
};
const chain = sql.insert().into('users');
sqlify(chain, resource);
chain.toString();
// => INSERT INTO users (name, age) VALUES ('Swat', 22)
sqlify
exposes a function, module (squel) and a Resource
type (for using with TypeScript).
The function receives 2 arguments. They are:
chain
resource
const { squel, sqlify } = require('sqlify');
chain
and resource
chain
is an instance of squel.
For example,
// ...
const chain = squel.select().from('users');
// ...
resource
is an object which contains the data to build the query.
Example:
// ...
const resource = {
field: ['name', 'age', 'address'],
where: {
name: 'Swa',
age: 22
}
};
// ...
Where, the properties of resource
object (in the above case, field
and where
) are taken from the chain function names of the squel. There are more. Refer their docs and use them accordingly.
When used with TypeScript, you should mark type of
resource
with theimport
edResource
class. Likeconst resource:Resource = {...}
.
// ...
sqlify(chain, resource);
// ...
sqlify
function wont return anything. It simply do things in in-place.
// ...
// parse query
const query = chain.toString();
// see it
console.log(query);
// => SELECT name, age, address FROM users WHERE (name='Swa') AND (age=22)
// ...
Unclear about something here? Feel free to rise an issue..
Since sqlify
takes in and out chain functions, you can modify it even after sqlify
ing it.
Example:
// ...
const chain = squel.select().from('users');
sqlify(chain, resource);
chain.limit(10);
chain.toString(); // Voila!
The following fields can be used inside the resource
object. Logic behind the usage of these functions can be found at squel docs.
cross_join | field | join | left_join | outer_join |
returning | right_join | set | where | group |
order | ||||
change the way you require
the package:
sqlify
along with squel
as:const sqlify = require('sqlify');
const squel = require('squel');
// ...
const { sqlify, squel } = require('sqlify');
// ...
change in function name: change fields:[]
to field:[]
in the resource
object.
Oh yes! it's that simple.
order
function from squel-ordergroup
function from squel-grouppackage.json
)MIT © Vajahath Ahmed
FAQs
Yet another SQL query builder for Node.js
The npm package sqlify receives a total of 9 weekly downloads. As such, sqlify popularity was classified as not popular.
We found that sqlify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.