safesql

library2.0.2jsnpmunverified

safesql is an npm package (v2.0.2) that provides ES6 template tag functions for safely composing MySQL and PostgreSQL query strings. It automatically escapes dynamic values based on context (identifiers, values, raw expressions) to prevent SQL injection. Written by Mike Samuel, a security engineer, it is part of the template-tag-common family. The library is lightweight, has no runtime dependencies, and supports both CommonJS and ESM (via bundlers). Unlike string concatenation or naive escaping, safesql uses tagged template literals to distinguish between identifiers and values, and handles arrays, objects, and nested SqlFragment instances correctly. Release cadence is low, with version 2.0.2 current as of 2024.

security database

npm install safesql

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SAFESQL

safesql

securityjavascriptv2.0.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

mysql

✓ import { mysql } from 'safesql'

✗ const mysql = require('safesql').mysql

Available as a named export. For CommonJS, use destructuring require.

✓ import { pg } from 'safesql'

✗ const pg = require('safesql').pg

PostgreSQL variant; same import pattern as mysql.

SqlFragment

✓ import { SqlFragment } from 'safesql'

✗ import SqlFragment from 'safesql'

Named export for the result type; not default export.

SqlId

✓ import { SqlId } from 'safesql'

Constructor for SQL identifiers; use as an alternative to backtick syntax.

Demonstrates building a safe SQL UPDATE query with identifier escaping, object SET clause, and nested raw SQL via SqlFragment.

import { mysql, SqlId } from 'safesql'; const table = 'users'; const userId = 1; const data = { email: 'test@example.com', modified: mysql`NOW()` }; const query = mysql`UPDATE \`${table}\` SET ${data} WHERE \`id\` = ${userId}`; console.log(query); // UPDATE `users` SET `email` = 'test@example.com', `modified` = NOW() WHERE `id` = 1

Debug

Known issues

gotchaDo not use regular template strings with database calls; safesql requires the template tag function to properly escape values.

fix

Always prefix your SQL string with the mysql or pg tag, e.g., mysql`SELECT ...` not just `SELECT ...`.

affects: >=1.0.0

gotchaIdentifiers must be wrapped in escaped backticks (for MySQL) or escaped double quotes (for PostgreSQL) at the template literal level.

fix

Use ${} inside \` `identifier`\` for MySQL or "${identifier}" for PostgreSQL to mark identifiers.

affects: >=1.0.0

gotchaThe package does not validate the final SQL syntax; it only escapes values based on context. Incorrect use can still produce malformed SQL.

fix

Rely on safesql for escaping, but test your queries with a database to ensure correctness.

affects: >=1.0.0

deprecatedThe default export pattern (e.g., import safesql from 'safesql') is not available; only named exports exist.

fix

Use named imports: import { mysql, pg, SqlFragment, SqlId } from 'safesql'.

affects: >=2.0.0

Errors

Common errors & fixes

TypeError: safesql_1.default is not a function

Using default import when only named exports are available.

fix

Change to named import: import { mysql } from 'safesql'

Error: Invalid SQL: Unexpected token

Using safesql on a string that contains syntax errors or unescaped backticks.

fix

Ensure template literals use escaped backticks for identifiers: \`table\`

ReferenceError: mysql is not defined

Incorrect import path or missing import statement.

fix

Add import: import { mysql } from 'safesql'

Cannot find module 'safesql' or its corresponding type declarations.

Package not installed or TypeScript missing type definitions.

fix

Run npm install safesql. TypeScript types are included via @types/safesql if needed.

Upgrade

Version history

2.0.2latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

24 hits · last 30 days

node