Skip to content

Conversation

@asg017
Copy link
Contributor

@asg017 asg017 commented Sep 19, 2023

This PR adds a new .sql tagged template to the database class. It allows users to easily run one-off SQL queries with parameters bounded with a tagged templated. Parameters are safely encoded as ? and bounded after the statement is prepared, meaning there's no possibility of SQL injection.

db.sql`create table students(id, name)`;

const student = {id: 1, name: "Alex"};
db.sql`insert into students values (${student.id}, ${student.name})`;

db.sql`select * from students where id > ${0}`; // [ {"id": 1, "name": "Alex"} ]

The .sql tagged template returns all the rows returned by the query, calling .all() under the hood.

The function is inspired by, and has a very similar API to these other libraries:

@asg017
Copy link
Contributor Author

asg017 commented Sep 19, 2023

Looks like @vercel/postgres has some extra checks to ensure that their .sql tagged template isn't executing as a function, which could lead to SQL injection. Let me know if you'd like to see a similar check here in this PR! https://github.com/vercel/storage/blob/ce8d087d27c99372a6505e03ec8222134db48ebf/packages/postgres/src/sql-template.ts#L9C1-L14

Copy link
Member

@DjDeveloperr DjDeveloperr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@DjDeveloperr DjDeveloperr merged commit 875a609 into denodrivers:main Sep 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants