selectstar

library1.1.11jsnpmunverified

Selectstar is a JavaScript/TypeScript library for generating safe, parameterized SQL queries for PostgreSQL using tagged template literals. Current stable version is 1.1.11, maintained since 2018. It provides primitives for constructing dynamic queries without SQL injection risks: parameterized values, query fragments (template), dynamic identifiers, and lists. Unlike alternatives like squel or knex, selectstar stays close to raw SQL syntax while enforcing parameterization — it is ignorant of query semantics, making it ideal for complex or raw SQL generation. It is fully typed (TypeScript declarations included) and integrates directly with node-postgres (pg) via query objects containing text and values. The package has no runtime dependencies.

database

npm install selectstar

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SELECTSTAR

selectstar

databasejavascriptv1.1.11

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sql

✓ import { sql } from 'selectstar'

✗ import sql from 'selectstar'

sql is a named export, not a default export. Common mistake when migrating from CJS to ESM.

template

✓ import { template } from 'selectstar'

✗ const { template } = require('selectstar')

template is a named export. CJS require() is also valid but the wrong example shows destructuring from require — actually that's fine. The common mistake is trying to use template as a default import or not importing it at all.

identifier

✓ import { identifier } from 'selectstar'

✗ const identifier = require('selectstar').identifier

identifier is a named export. The CJS pattern using dot notation is valid, but the ESM named import is preferred for TypeScript.

list

✓ import { list } from 'selectstar'

✗ const list = require('selectstar').list

List is a named export. Ensure you import it correctly to generate comma-separated SQL lists.

types

✓ import type { Query } from 'selectstar'

✗ import { Query } from 'selectstar'

Use 'import type' for TypeScript type-only imports to avoid runtime bloat. Query is the type of objects returned by sql``.

Demonstrates basic parameterized query, dynamic identifier, and integration with node-postgres pool.query.

import { sql, template, identifier, list } from 'selectstar'; import { Pool } from 'pg'; const pool = new Pool(); async function runQuery() { const id = 42; const tableName = 'users'; const columns = ['id', 'name']; const rows = [{ name: 'Alice' }, { name: 'Bob' }]; const query = sql`SELECT ${identifier(columns[0])} FROM ${identifier(tableName)} WHERE id = ${id}`; // => { text: 'SELECT "id" FROM "users" WHERE id = $1', values: [42] } const result = await pool.query(query); console.log(result.rows); } runQuery().catch(console.error);

Debug

Known issues

gotchaTemplate literals are not compiled: they generate Query objects at runtime. Performance overhead is minimal but be aware that each call to sql`` creates a new object.

fix

Cache static queries outside hot loops if needed; e.g., const query = sql`SELECT 1`;

affects: >=0.0.0

gotchaidentifier does not escape user input enough: it only quotes identifiers using node-postgres's escapeIdentifier. Do not use with untrusted strings that might contain quotes or backslashes without additional validation.

fix

Validate or whitelist identifiers (e.g., column names) before passing to identifier().

affects: >=0.0.0

gotchaList with no elements: calling list([]) or list with an empty array results in an empty string, which can cause syntax errors if inserted into a query expecting at least one item (e.g., IN ()).

fix

Check array length before constructing list: if (items.length === 0) throw new Error('Need at least one item');

affects: >=0.0.0

gotchaIf you use template inside sql literal but pass it directly (not as a placeholder), the result might be incorrect. Always use ${template`...`} interpolation.

fix

Wrap template usage in ${} within sql``: sql`SELECT * FROM ${template`users`}` — though in this simple case identifier is safer.

affects: >=0.0.0

breakingBefore v1.0.0, the library returned a different object shape with keys 'sql' and 'params'. In v1.0.0+, it returns { text, values }. Upgrading from pre-1.0 breaks pg integration.

fix

Upgrade to >=1.0.0 and use { text, values } object. Old call sites: { sql: '...', params: [...] } should be changed.

affects: <1.0.0

Errors

Common errors & fixes

TypeError: (0 , selectstar.sql) is not a function

Default import used when only named exports exist: import sql from 'selectstar' instead of import { sql } from 'selectstar'.

fix

Change import to: import { sql } from 'selectstar';

Cannot find module 'selectstar' or its corresponding type declarations.

Missing npm install or TypeScript cannot find package types. Package ships .d.ts files, so no @types/selectstar needed.

fix

Run 'npm install selectstar' and ensure tsconfig.json includes 'node_modules/@types' or 'moduleResolution': 'node'.

ERROR: 'identifier' is not defined

Using identifier as a global function without importing it.

fix

Add: import { identifier } from 'selectstar';

Type 'Query' is not assignable to parameter of type 'string'

Attempting to pass a sql`` result directly to a function expecting a string (e.g., console.log(query)). The Query object is not a string; use query.text for debugging.

fix

Use query.text to get the SQL string, or JSON.stringify(query) to inspect both text and values.

Upgrade

Version history

1.1.11latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

5 hits · last 30 days

node