sql-escaper

library1.3.3jsnpmunverified

SQL Escaper is a drop-in replacement for sqlstring that uses an AST-based approach for faster SQL escaping and formatting, with TypeScript types and ESM/CJS support. Current version is 1.3.3, released actively with weekly/monthly updates on npm. It provides ~40% faster performance, support for BigInt and Uint8Array, and fixes a previously reported SQL injection vulnerability in older mysqljs/mysql versions. Key differentiators: security-aware, modern target (Node 12+, Bun, Deno), and proper keyword/value distinction.

database security

npm install sql-escaper

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQL-ESCAPER

sql-escaper

databasejavascriptv1.3.3

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

escape

✓ import { escape } from 'sql-escaper'

✗ const escape = require('sql-escaper')

Named ESM import; CommonJS require works if using CJS module system, but prefer ESM for tree-shaking.

format

✓ import { format } from 'sql-escaper'

✗ import format from 'sql-escaper'

format is a named export, not a default export.

escapeId

✓ import { escapeId } from 'sql-escaper'

Also available as named export.

Demonstrates named imports, identifier and value escaping, format query building, Uint8Array/BigInt support, and optional mysql2 integration.

import { escape, format, escapeId } from 'sql-escaper'; const id = 'user; DROP TABLE users;'; const safeId = escapeId(id); // backtick-quoted identifier const name = "O'Brien"; const safeName = escape(name); // single-quoted and escaped const query = format('SELECT * FROM ?? WHERE name = ?', [safeId, safeName]); console.log(query); // SELECT * FROM `user; DROP TABLE users;` WHERE name = 'O\'Brien' // Uint8Array and BigInt support const arr = new Uint8Array([0, 1, 2]); const big = 123n; console.log(escape(arr)); // x'000102' console.log(escape(big)); // '123' // Using with mysql2 (optional) import mysql from 'mysql2/promise'; const conn = await mysql.createConnection({ host: 'localhost', user: 'root', password: process.env.DB_PASS ?? '' }); await conn.query('SELECT ?', [escape('test')]); await conn.end();

Debug

Known issues

gotchaObjects outside SET/ON DUPLICATE KEY UPDATE are stringified as '[object Object]' to prevent SQL injection, not expanded as they were in old sqlstring.

fix

Ensure you do not rely on object expansion in queries; use explicit placeholders for each property.

affects: >=1.0.0

deprecatedmysqljs/mysql (not mysql2) still uses old sqlstring; using sql-escaper as an override may cause incompatibilities with mysqljs/mysql internals.

fix

Migrate to mysql2 (v3.17+) which uses sql-escaper natively, or test thoroughly if overriding.

affects: >=1.0.0

gotchaNode.js <12 is not supported; sqlstring supported Node 0.6, but sql-escaper requires Node >=12.

fix

Upgrade Node.js to v12 or later.

affects: >=1.0.0

gotchaDeno imports require npm specifier: `import { escape } from 'npm:sql-escaper'`.

fix

Use the npm: prefix in Deno: `import { escape } from 'npm:sql-escaper'`.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: sql_escaper_1.escape is not a function

Default import instead of named import in ESM.

fix

Use `import { escape } from 'sql-escaper'` instead of `import escape from 'sql-escaper'`

Cannot find module 'sql-escaper' or its corresponding type declarations.

Missing TypeScript types or incorrect module resolution.

fix

Ensure tsconfig.json has `moduleResolution: 'node'` or `'node16'`. The package ships types, so it should resolve automatically.

Error [ERR_REQUIRE_ESM]: require() of ES Module not supported.

Using CommonJS require() with ESM-only package (but sql-escaper supports both CJS and ESM; this error occurs if only ESM is imported in a CJS project).

fix

Use dynamic import() or switch to ESM module type in package.json: `"type": "module"`

Upgrade

Version history

1.3.3latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

34 hits · last 30 days

node