pg-escape

library0.2.0jsnpmunverified

Sprintf-style PostgreSQL query escaping and formatting library for Node.js. Current stable version 0.2.0 (released 2012, no updates since). Offers %s, %L, %I, %Q format specifiers for strings, literals, identifiers, and dollar-quoted strings. Unlike parameterized queries (which keep queries safe), this escapes inline into SQL strings, suitable for dynamic query construction where parameters cannot be used. Works in Node.js only.

database

npm install pg-escape

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · PG-ESCAPE

pg-escape

databasejavascriptv0.2.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

escape

✓ const escape = require('pg-escape')

✗ import escape from 'pg-escape'

Package is CJS-only; no ESM wrapper or default export.

escape.string

✓ const { string } = require('pg-escape')

Access sub-exports via destructuring or property access.

escape.literal

✓ const escape = require('pg-escape'); escape.literal(val)

Prefer %L format specifier instead of calling literal directly.

Shows basic sprintf-style formatting with %I (identifier), %L (literal), %s (simple string), and %Q (dollar-quoted string).

const escape = require('pg-escape'); const title = "O'Reilly"; const table = 'books'; const sql = escape('INSERT INTO %I VALUES(%L, %s)', table, title, 'Genres'); console.log(sql); // INSERT INTO books VALUES('O''Reilly', Genres) // Dollar-quoted string: const dollar = escape('SELECT %Q AS content', "It's safe"); console.log(dollar); // SELECT $tag$It's safe$tag$ AS content

Debug

Known issues

gotchaString conversion: %s converts null to empty string, not NULL keyword.

fix

Use %L for SQL NULL literal; check for null separately.

affects: >=0.0.0

gotchaIdentifier validation: %I does not validate identifiers; can produce invalid SQL if value contains quotes.

fix

Sanitize identifiers before using %I or avoid user input.

affects: >=0.0.0

gotchaNo parameterized queries: pg-escape escapes values inline; risk of SQL injection if misused.

fix

Prefer pg's parameterized queries ($1, $2) over inline escaping.

affects: >=0.0.0

deprecatedPackage is unmaintained; last release 2012.

fix

Consider using pg-promise or sql-template-strings for active alternatives.

affects: >=0.0.0

Errors

Common errors & fixes

TypeError: escape is not a function

Using ESM import syntax with this CJS-only package.

fix

Change to const escape = require('pg-escape');

Error: %I format requires a non-null argument

Passing null or undefined to %I specifier.

fix

Ensure identifier values are strings; check for null before formatting.

SyntaxError: Unexpected token ILLEGAL

Incorrect quoting or unescaped backslash in arguments.

fix

Use %L for literal values to properly escape single quotes and backslashes.

Upgrade

Version history

0.2.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

5 hits · last 30 days

node

Resources

githubhttps://github.com/segmentio/pg-escape ↗

packagepg-escape ↗

homepagehttps://github.com/segmentio/pg-escape#readme ↗