Node.js implementation of PostgreSQL's format() function for safely constructing dynamic SQL queries. Version 1.3.5 is stable and actively maintained, with TypeScript type definitions included. It escapes SQL identifiers (%I) and literals (%L) to prevent SQL injection, supports argument position reordering (n$ syntax), Node Buffers, arrays, and objects. Unlike template literal concatenation (which is unsafe), this library mirrors PostgreSQL's own format() behavior exactly, making it ideal for tools that generate SQL dynamically. The release cadence is low (occasional patches), but the library is mature and reliable.
npm install node-pg-formatNo compatibility data collected yet for this library.
Verified import paths — ran on the pinned version, not inferred.
Shows importing and using format(), formatWithArray(), quoteIdent(), quoteLiteral(), argument positions, and array/object handling.
Ensure format() is only used to build single SQL statements. Do not embed user input that could contain semicolons as %s; use %I or %L for identifiers/literals.
Be aware that quoted identifiers are case-sensitive. Use consistent casing (e.g., lowercase) for unquoted identifiers to avoid unexpected behavior.
Always validate inputs before passing to format() if you expect non-null values, especially for identifiers. Consider wrapping in a null-check.
Only pass plain objects (not class instances, Maps, Sets, etc.) to %L. Use JSON.stringify() beforehand if you need custom serialization.
Avoid using format.config() in production. If you need custom patterns, consider forking the library or wrapping the format call with local configuration.
Run `npm install node-pg-format` in your project root.
Use named import: `import { format } from 'node-pg-format'`.Ensure you only pass non-null strings to %I. Use a conditional or default value: `const ident = name ?? 'default'`.
No dependency data recorded yet.