Registry / security / eslint-plugin-sql-template

eslint-plugin-sql-template

library3.2.0jsnpmunverified

ESLint plugin (v3.2.0, maintained) that enforces the use of the `sql` template tag on raw SQL queries to prevent SQL injection. Provides the `no-unsafe-query` rule which disallows interpolated template literals in SQL strings unless tagged with `sql`. Requires ESLint >=9 and Node >=20. Distinct from eslint-plugin-sql or eslint-plugin-safe-sql by focusing specifically on template tag usage rather than SQL syntax validation.

security devops

npm install eslint-plugin-sql-template

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-SQL-

eslint-plugin-sql-template

securityjavascriptv3.2.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import sqlTemplate from 'eslint-plugin-sql-template'

✗ const sqlTemplate = require('eslint-plugin-sql-template')

ESM-only package since v3. No default CommonJS export.

rules

✓ import sqlTemplate from 'eslint-plugin-sql-template'; const rules = sqlTemplate.rules

✗ const { rules } = require('eslint-plugin-sql-template')

Access rules via default import in ESM.

no-unsafe-query

✓ import sqlTemplate from 'eslint-plugin-sql-template'; const rule = sqlTemplate.rules['no-unsafe-query']

✗ import { noUnsafeQuery } from 'eslint-plugin-sql-template'

Rules are not named exports; access via default import's rules object.

Sets up ESLint flat config to disallow unsafe SQL template literals using the sql-template plugin.

import sqlTemplate from 'eslint-plugin-sql-template'; export default [ { plugins: { 'sql-template': sqlTemplate }, rules: { 'sql-template/no-unsafe-query': 'error' } } ]; // Example usage: const sql = (strings, ...values) => strings.reduce((acc, str, i) => acc + values[i - 1] + str); const query = sql`SELECT * FROM users WHERE id = ${42}`; // OK const unsafe = `SELECT * FROM users WHERE id = ${42}`; // fails

Debug

Known issues

breakingESM-only: package no longer provides CommonJS exports (require) as of v3.0.0.

fix

Use import syntax and ensure Node >=20. If using CommonJS, stay on v2.x.

affects: >=3.0.0

breakingPeer dependency ESLint >=9 required. ESLint 8 and below are not supported.

fix

Upgrade ESLint to version 9 or later.

affects: >=3.0.0

deprecatedESLint flat config must be used; .eslintrc format is not supported.

fix

Migrate to eslint.config.js.

affects: >=3.0.0

gotchaThe plugin does not detect SQL injection if the sql tag is imported from a different module; it only checks for the presence of any tag named sql.

fix

Ensure the sql tag is named exactly sql; otherwise the rule will not flag untagged templates.

affects: all

gotchaRule no-unsafe-query only flags template literals that contain interpolation and appear in a SQL context (heuristic). It may produce false negatives for complex expressions.

fix

Review all template literals manually if high security is needed.

affects: all

Errors

Common errors & fixes

Error: Cannot find module 'eslint-plugin-sql-template'

Package not installed or resolved in ESM context.

fix

npm install eslint eslint-plugin-sql-template --save-dev

Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './package.json' is not defined by "exports"

Using require() in CJS with v3 of the package.

fix

Switch to import syntax or downgrade to v2.

Configuration for rule "sql-template/no-unsafe-query" is invalid: Value "error" is not a valid severity.

Using .eslintrc configuration file instead of flat config.

fix

Upgrade to ESLint 9 and use eslint.config.js.

Error: ESLint configuration in eslint.config.js » plugins: Property 'sql-template' is missing definition.

Plugin object key must match rule prefix exactly.

fix

Use 'sql-template': sqlTemplate in plugins object.

Upgrade

Version history

3.2.0latest on npm

Audit

Dependencies

eslintrequiredPeer dependency: requires ESLint >=9 for flat config support

Agent activity

19 hits · last 30 days

node

OpenAI (training)

Resources

githubssh://git@github.com/uphold/eslint-plugin-sql-template ↗

packageeslint-plugin-sql-template ↗

homepagehttps://github.com/uphold/eslint-plugin-sql-template#readme ↗