check-sql-query

library1.0.0jsnpmunverified

Utility library (v1.0.0) for detecting SQL operation types (SELECT, INSERT, UPDATE, DELETE, etc.), determining read-only status, and validating parameter binding. Supports positional ($1, ?) and named (@, :, $) parameter styles for PostgreSQL, MySQL, SQLite. Isomorphic (works in Node.js and browsers), with TypeScript support and 0 dependencies. Lightweight alternative to SQL parsers like sql-parser or node-sql-parser for simple query classification.

database security

npm install check-sql-query

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · CHECK-SQL-QUERY

check-sql-query

databasejavascriptv1.0.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

checkSqlQuery

✓ import { checkSqlQuery } from 'check-sql-query'

✗ const checkSqlQuery = require('check-sql-query')

Named export. This is default-like but actually named. Mixed CJS/ESM via package.json exports.

SqlType

✓ import type { SqlType } from 'check-sql-query'

✗ import { SqlType } from 'check-sql-query'

TypeScript type only. Do not import at runtime.

CheckSqlQueryResult

✓ import type { CheckSqlQueryResult } from 'check-sql-query'

✗ import { CheckSqlQueryResult } from 'check-sql-query'

TypeScript type for the function's return value. Not exported as value.

Detects read-only SQL queries and validates parameter binding with positional and named placeholders.

import { checkSqlQuery } from 'check-sql-query'; // Read-only SELECT with positional param const result1 = checkSqlQuery('SELECT * FROM users WHERE id = $1', [1]); console.log(result1); // { readonly: true, types: ['select'] } // INSERT with named param const result2 = checkSqlQuery('INSERT INTO users (name) VALUES (@name)', { name: 'Alice' }); console.log(result2); // { readonly: false, types: ['insert'] } // Parameter count mismatch const result3 = checkSqlQuery('SELECT * FROM users WHERE id = $1', [1, 2, 3]); console.log(result3); // { readonly: true, types: ['select'], error: 'too many parameter in array, expected 1, got 3' }

Debug

Known issues

gotchaMixed parameter styles ($1 and ?) in same query cause error

fix

Use only one style: either all $1 (PostgreSQL) or all ? (MySQL/SQLite)

affects: >=1.0.0

gotchaThe function does not parse SQL syntax, only classifies by first keyword. Complex queries like 'WITH ... SELECT' may be misclassified.

fix

For accurate operation detection on CTEs or subqueries, consider using a full SQL parser.

affects: >=1.0.0

breakingNo breaking changes known as of v1.0.0 — minor version bumps may introduce new features.

fix

Pin to ^1.0.0 during initial adoption.

affects: >=1.0.0 <2.0.0

deprecatedNo deprecated APIs reported yet.

fix

N/A

affects: >=1.0.0

gotchaParameter validation only checks count for positional arrays; for objects, excess keys are ignored.

fix

When using named params, ensure all placeholders are covered; unmatched keys are silently ignored.

affects: >=1.0.0

gotchaThe 'readonly' flag is true only if ALL operations are SELECT. Mixing SELECT with INSERT makes it false.

fix

If you need to detect any SELECT-like operation, check 'types' array directly.

affects: >=1.0.0

Errors

Common errors & fixes

Error: mixed "$1" and "?" style parameters

Using both $1 and ? placeholders in the same SQL query.

fix

Choose one style: e.g., 'SELECT * FROM users WHERE id = ? AND name = ?' or 'SELECT * FROM users WHERE id = $1 AND name = $2'.

Error: too many parameter in array, expected N, got M

Number of positional parameters in array does not match number of placeholders.

fix

Ensure the array length equals the placeholder count. For named parameters, use an object instead of an array.

Error: expected parameter M but got undefined

Missing value for a named placeholder (e.g., @id not provided in object).

fix

Include all named parameters in the object, e.g., { id: 1 }.

TypeError: checkSqlQuery is not a function

Incorrect import: using default import instead of named import.

fix

Use import { checkSqlQuery } from 'check-sql-query'.

Upgrade

Version history

1.0.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

40 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/beenotung/check-sql-query ↗

packagecheck-sql-query ↗

homepagehttps://github.com/beenotung/check-sql-query#readme ↗