Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a .sql tagged template for executing one-off SQL queries #108

Merged
merged 2 commits into from
Sep 25, 2023

Conversation

asg017
Copy link
Contributor

@asg017 asg017 commented Sep 19, 2023

This PR adds a new .sql tagged template to the database class. It allows users to easily run one-off SQL queries with parameters bounded with a tagged templated. Parameters are safely encoded as ? and bounded after the statement is prepared, meaning there's no possibility of SQL injection.

db.sql`create table students(id, name)`;

const student = {id: 1, name: "Alex"};
db.sql`insert into students values (${student.id}, ${student.name})`;

db.sql`select * from students where id > ${0}`; // [ {"id": 1, "name": "Alex"} ]

The .sql tagged template returns all the rows returned by the query, calling .all() under the hood.

The function is inspired by, and has a very similar API to these other libraries:

@asg017
Copy link
Contributor Author

asg017 commented Sep 19, 2023

Looks like @vercel/postgres has some extra checks to ensure that their .sql tagged template isn't executing as a function, which could lead to SQL injection. Let me know if you'd like to see a similar check here in this PR! https://github.com/vercel/storage/blob/ce8d087d27c99372a6505e03ec8222134db48ebf/packages/postgres/src/sql-template.ts#L9C1-L14

Copy link
Member

@DjDeveloperr DjDeveloperr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@DjDeveloperr DjDeveloperr merged commit 875a609 into denodrivers:main Sep 25, 2023
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants