sql-escape-string

library1.1.0jsnpmunverified

A simple SQL string escape utility that escapes single quotes and optionally backslashes to prevent SQL injection. Version 1.1.0 is stable with no recent updates; it is derived from the mysqljs/sqlstring library but adds an option to disable backslash escaping, which is non-standard SQL. Unlike general-purpose escape libraries, this package focuses solely on SQL string escaping and is lightweight with no dependencies.

security

npm install sql-escape-string

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQL-ESCAPE-STRING

sql-escape-string

securityjavascriptv1.1.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import escapeString from 'sql-escape-string'

✗ const escapeString = require('sql-escape-string')

Package ships ESM and CJS. Use default import for ESM; require also works for CJS.

escapeString

✓ import escapeString from 'sql-escape-string'

✗ import { escapeString } from 'sql-escape-string'

This package exports a single function as default, not as a named export.

type import

✓ import type { EscapeOptions } from 'sql-escape-string'

Types are not included; this is a JavaScript-only package. Use JSDoc or custom types.

Shows basic usage: import, escape a string with single quotes, and difference with backslashSupported option.

import escapeString from 'sql-escape-string'; const unsafe = "O'Brien"; // Default: backslash not supported, single quotes escaped via doubling console.log(escapeString(unsafe)); // 'O''Brien' // With backslash support console.log(escapeString(unsafe, { backslashSupported: true })); // 'O\'Brien' // Special characters are not escaped if backslash not supported const withBackslash = "path\\to\\file"; console.log(escapeString(withBackslash)); // 'path\\to\\file' (backslash is literal) // Note: The function wraps the result in single quotes automatically.

Debug

Known issues

gotchaBy default, backslashes are NOT escaped because they are not standard SQL; double quotes are also not escaped. This may lead to SQL injection if your SQL engine interprets backslash escapes (e.g., MySQL with NO_BACKSLASH_ESCAPES disabled).

fix

Always set { backslashSupported: true } if your SQL engine supports backslash escapes, or verify your engine's behavior.

affects: >=0.0.1

breakingVersion 1.0.0 changed the import from 'sql-string-escape' to 'sql-escape-string'. Old code using the previous name will not work.

fix

Update imports: require('sql-escape-string') instead of require('sql-string-escape').

affects: =1.0.0

deprecatedThe 'backslashSupported' option is not deprecated, but the default behavior may be surprising. Consider always specifying it explicitly.

fix

Explicitly pass { backslashSupported: true } or { backslashSupported: false } to make intent clear.

affects: >=1.0.0

gotchaThe function always wraps the result in single quotes, which is not suitable for identifier escaping or number literals.

fix

Use a dedicated identifier escape function if needed; for numbers, convert to string manually.

affects: >=0.0.1

Errors

Common errors & fixes

Error: Cannot find module 'sql-string-escape'

Package was renamed from 'sql-string-escape' to 'sql-escape-string' in version 1.0.0.

fix

npm install sql-escape-string and replace require('sql-string-escape') with require('sql-escape-string').

TypeError: escapeString is not a function

Importing incorrectly as named export instead of default export.

fix

Use 'import escapeString from 'sql-escape-string'' or 'const escapeString = require('sql-escape-string')'.

ReferenceError: escapeString is not defined

Forgetting to install or import the package.

fix

npm install sql-escape-string and add import at top of file.

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

18 hits · last 30 days

node

OpenAI (training)

Resources

githubgit://github.com/thlorenz/sql-escape-string ↗

packagesql-escape-string ↗

homepagehttps://github.com/thlorenz/sql-escape-string ↗