You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This package provides utilities for building SQL query strings in a safe, composable, and parameterized manner. It is designed to prevent SQL injection vulnerabilities and enhance code readability when constructing complex queries.
@@ -22,7 +25,7 @@ Additionally, the package offers `UnsafeQueryLiteral` for situations where direc
22
25
## `sql` Tagged Template Literal
23
26
24
27
```typescript
25
-
import { sql } from"sql-query-builder";
28
+
import { sql } from"sql-string-builder";
26
29
```
27
30
28
31
The `sql` tagged template literal is the most convenient and recommended way to create `QueryStringBuilder` instances. It allows you to write SQL queries in a template literal syntax, embedding JavaScript/TypeScript expressions as parameterized values.
@@ -40,7 +43,7 @@ const query = sql`SQL query text with ${parameter1} and ${parameter2}`;
`UnsafeQueryLiteral` is a special type that wraps a string. When a `QueryStringBuilder` encounters an `UnsafeQueryLiteral`, it **directly interpolates** the string value into the SQL query without parameterization or escaping.
@@ -77,7 +80,7 @@ import { UnsafeQueryLiteral } from "sql-query-builder";
77
80
**Example (Use with Caution - for illustration only):**
`QueryStringBuilder` is the primary class in this package for constructing SQL queries. It provides a fluent interface for appending SQL fragments and parameterized values.
@@ -132,7 +135,7 @@ Appends another `QueryStringBuilder` to the current builder. This is the core me
132
135
**Example:**
133
136
134
137
```typescript
135
-
import { sql } from"sql-query-builder";
138
+
import { sql } from"sql-string-builder";
136
139
137
140
const selectClause =sql`SELECT * FROM users`;
138
141
const whereClause =sql`WHERE age > ${18}`;
@@ -163,7 +166,7 @@ Similar to `UnsafeQueryLiteral`, `appendRawString` bypasses parameterization and
163
166
**Example (Use with Caution - for illustration only):**
164
167
165
168
```typescript
166
-
import { sql } from"sql-query-builder";
169
+
import { sql } from"sql-string-builder";
167
170
168
171
const orderByClause =sql`ORDER BY created_at`;
169
172
const direction ="DESC"; // Static, known direction
@@ -186,7 +189,7 @@ Creates a new, mutable `QueryStringBuilder` that is a copy of the current builde
186
189
**Example:**
187
190
188
191
```typescript
189
-
import { sql } from"sql-query-builder";
192
+
import { sql } from"sql-string-builder";
190
193
191
194
const baseQuery =sql`SELECT * FROM products`;
192
195
const query1 =baseQuery.clone().append(sql` WHERE price < ${100}`);
@@ -221,7 +224,7 @@ Finalizes the `QueryStringBuilder` and generates the SQL query string and an arr
221
224
**Example:**
222
225
223
226
```typescript
224
-
import { sql } from"sql-query-builder";
227
+
import { sql } from"sql-string-builder";
225
228
226
229
const name ="John Doe";
227
230
const age =30;
@@ -246,7 +249,7 @@ Returns an approximate length of the SQL query string being built. This can be u
246
249
**Example:**
247
250
248
251
```typescript
249
-
import { sql } from"sql-query-builder";
252
+
import { sql } from"sql-string-builder";
250
253
251
254
const longQuery =sql``;
252
255
for (let i =0; i<100; i++) {
@@ -258,7 +261,7 @@ console.log(longQuery.approximateLength()); // Output: A number representing the
258
261
259
262
## Helper Functions
260
263
261
-
The `sql-query-builder` package provides several helper functions to simplify common SQL construction tasks.
264
+
The `sql-string-builder` package provides several helper functions to simplify common SQL construction tasks.
-**SQL Injection Prevention:** This package is designed to help prevent SQL injection vulnerabilities by promoting the use of parameterized queries. Always use parameterized values (using `${expression}` within the `sql` template literal) for any data that originates from user input or untrusted sources.
361
364
-**`UnsafeQueryLiteral` and `appendRawString`:** These features should be used with extreme caution and only when absolutely necessary for static, trusted parts of the SQL query. Improper use can reintroduce SQL injection risks. Thoroughly review and understand the security implications before using them.
362
365
363
-
By using the `sql-query-builder` package correctly, you can build robust, readable, and secure SQL queries in your applications.
366
+
By using the `sql-string-builder` package correctly, you can build robust, readable, and secure SQL queries in your applications.
0 commit comments