Registry / database / sql-statement

sql-statement

JSON →
library1.1.0jsnpmunverified

sql-statement is a tiny, tree-shakeable SQL statement builder (v1.1.0, last updated 2025) that safely escapes identifiers and values using placeholders (? for values, ?? for identifiers). Unlike ORMs or full query builders, it provides minimal abstraction: you write raw SQL fragments and use append, appendList, and appendPairs to compose queries. Ships TypeScript definitions and supports MySQL, PostgreSQL, and SQLite quoting styles via named exports (mysql, Pg, Sqlite). No database connectivity — generates final SQL strings for use with any driver. Release cadence is low; package is stable and lightweight (no dependencies).

database
github ↗package ↗homepage ↗
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

The package exports dialect-specific builders. `mysql` is a function that constructs a SQL instance with MySQL quoting. The default export does not exist.

import { mysql as SQL } from 'sql-statement'

For PostgreSQL quoting, use the named export Pg. CommonJS require works but is not preferred with ESM.

import { Pg as SQL } from 'sql-statement'

Sqlite is the correct named export for SQLite quoting. The generic SQL name is not exported.

import { Sqlite } from 'sql-statement'

Shows basic usage: instantiating a MySQL-dialect SQL builder, appending a query with placeholders, and converting to final string.

import { mysql as SQL } from 'sql-statement'; const tableName = 'users'; const id = 'AC3C21E7'; const sql = new SQL(); sql.append('SELECT * FROM ?? WHERE id = ?', tableName, id); console.log(String(sql)); // => "SELECT * FROM `users` WHERE id = 'AC3C21E7'"
Debug
Known footguns
gotchaSQL class is not exported directly; use dialect-specific named exports like mysql, Pg, or Sqlite.
gotchaPlaceholder '??' escapes identifiers, '?' escapes values. Using them incorrectly can lead to SQL injection or syntax errors.
deprecatedThe appendList and appendPairs methods are stable but the separator for appendPairs defaults to ', '; ensure you pass the correct separator when needed.
Upgrade
Version history

Breaking-change detection hasn't run for this library yet.

Audit
Security & dependencies

CVE tracking and dependency tree are planned for a later release.

Agent activity
6 hits · last 30 days
gptbot
3
Resources
githubhttps://github.com/kawanet/sql-statement ↗
packagesql-statement ↗
homepagehttps://github.com/kawanet/sql-statement ↗