@@ -16,6 +16,8 @@ $ npm install sqlstring
1616
1717## Usage
1818
19+ <!-- eslint-disable no-unused-vars -->
20+
1921``` js
2022var SqlString = require (' sqlstring' );
2123```
@@ -29,21 +31,27 @@ provided data before using it inside a SQL query. You can do so using the
2931``` js
3032var userId = ' some user provided value' ;
3133var sql = ' SELECT * FROM users WHERE id = ' + SqlString .escape (userId);
34+ console .log (sql); // SELECT * FROM users WHERE id = 'some user provided value'
3235```
3336
3437Alternatively, you can use ` ? ` characters as placeholders for values you would
3538like to have escaped like this:
3639
3740``` js
38- var sql = SqlString .format (' SELECT * FROM users WHERE id = ?' , [userId]);
41+ var userId = 1 ;
42+ var sql = SqlString .format (' SELECT * FROM users WHERE id = ?' , [userId]);
43+ console .log (sql); // SELECT * FROM users WHERE id = 1
3944```
4045
4146Multiple placeholders are mapped to values in the same order as passed. For example,
4247in the following query ` foo ` equals ` a ` , ` bar ` equals ` b ` , ` baz ` equals ` c ` , and
4348` id ` will be ` userId ` :
4449
4550``` js
46- var sql = SqlString .format (' UPDATE users SET foo = ?, bar = ?, baz = ? WHERE id = ?' , [' a' , ' b' , ' c' , userId]);
51+ var userId = 1 ;
52+ var sql = SqlString .format (' UPDATE users SET foo = ?, bar = ?, baz = ? WHERE id = ?' ,
53+ [' a' , ' b' , ' c' , userId]);
54+ console .log (sql); // UPDATE users SET foo = 'a', bar = 'b', baz = 'c' WHERE id = 1
4755```
4856
4957This looks similar to prepared statements in MySQL, however it really just uses
@@ -96,15 +104,15 @@ provided by a user, you should escape it with `SqlString.escapeId(identifier)` l
96104``` js
97105var sorter = ' date' ;
98106var sql = ' SELECT * FROM posts ORDER BY ' + SqlString .escapeId (sorter);
99- // -> SELECT * FROM posts ORDER BY `date`
107+ console . log (sql); // SELECT * FROM posts ORDER BY `date`
100108```
101109
102110It also supports adding qualified identifiers. It will escape both parts.
103111
104112``` js
105113var sorter = ' date' ;
106114var sql = ' SELECT * FROM posts ORDER BY ' + SqlString .escapeId (' posts.' + sorter);
107- // -> SELECT * FROM posts ORDER BY `posts`.`date`
115+ console . log (sql); // SELECT * FROM posts ORDER BY `posts`.`date`
108116```
109117
110118If you do not want to treat ` . ` as qualified identifiers, you can set the second
@@ -113,7 +121,7 @@ argument to `true` in order to keep the string as a literal identifier:
113121``` js
114122var sorter = ' date.2' ;
115123var sql = ' SELECT * FROM posts ORDER BY ' + connection .escapeId (sorter, true );
116- // -> SELECT * FROM posts ORDER BY `date.2`
124+ console . log (sql); // SELECT * FROM posts ORDER BY `date.2`
117125```
118126
119127Alternatively, you can use ` ?? ` characters as placeholders for identifiers you would
@@ -135,8 +143,10 @@ You can use `SqlString.format` to prepare a query with multiple insertion points
135143utilizing the proper escaping for ids and values. A simple example of this follows:
136144
137145``` js
146+ var userId = 1 ;
138147var inserts = [' users' , ' id' , userId];
139148var sql = SqlString .format (' SELECT * FROM ?? WHERE ?? = ?' , inserts);
149+ console .log (sql); // SELECT * FROM `users` WHERE `id` = 1
140150```
141151
142152Following this you then have a valid, escaped query that you can then send to the database safely.
0 commit comments