sql-statement

library1.1.0jsnpmunverified

sql-statement is a tiny, tree-shakeable SQL statement builder (v1.1.0, last updated 2025) that safely escapes identifiers and values using placeholders (? for values, ?? for identifiers). Unlike ORMs or full query builders, it provides minimal abstraction: you write raw SQL fragments and use append, appendList, and appendPairs to compose queries. Ships TypeScript definitions and supports MySQL, PostgreSQL, and SQLite quoting styles via named exports (mysql, Pg, Sqlite). No database connectivity — generates final SQL strings for use with any driver. Release cadence is low; package is stable and lightweight (no dependencies).

database

npm install sql-statement

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQL-STATEMENT

sql-statement

databasejavascriptv1.1.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SQL

✓ import { mysql as SQL } from 'sql-statement'

✗ import SQL from 'sql-statement'

The package exports dialect-specific builders. `mysql` is a function that constructs a SQL instance with MySQL quoting. The default export does not exist.

✓ import { Pg as SQL } from 'sql-statement'

✗ const { Pg } = require('sql-statement')

For PostgreSQL quoting, use the named export Pg. CommonJS require works but is not preferred with ESM.

Sqlite

✓ import { Sqlite } from 'sql-statement'

✗ import { SQL } from 'sql-statement'

Sqlite is the correct named export for SQLite quoting. The generic SQL name is not exported.

Shows basic usage: instantiating a MySQL-dialect SQL builder, appending a query with placeholders, and converting to final string.

import { mysql as SQL } from 'sql-statement'; const tableName = 'users'; const id = 'AC3C21E7'; const sql = new SQL(); sql.append('SELECT * FROM ?? WHERE id = ?', tableName, id); console.log(String(sql)); // => "SELECT * FROM `users` WHERE id = 'AC3C21E7'"

Debug

Known issues

gotchaSQL class is not exported directly; use dialect-specific named exports like mysql, Pg, or Sqlite.

fix

Import the dialect: import { mysql as SQL } from 'sql-statement'

affects: >=0.1.0

gotchaPlaceholder '??' escapes identifiers, '?' escapes values. Using them incorrectly can lead to SQL injection or syntax errors.

fix

Always use '??' for column/table names and '?' for values. Example: sql.append('SELECT ?? FROM ?? WHERE ?', 'name', 'users', {id: 1})

affects: >=0.1.0

deprecatedThe appendList and appendPairs methods are stable but the separator for appendPairs defaults to ', '; ensure you pass the correct separator when needed.

fix

Explicitly pass separator: sql.appendPairs('?? = ?', obj, ' AND ')

affects: >=0.2.0

Errors

Common errors & fixes

TypeError: (intermediate value) is not a constructor

Importing default export instead of named dialect export.

fix

Change import to: import { mysql as SQL } from 'sql-statement'

Error: Unknown placeholder: "?"

Mixing up placeholder order or passing extra arguments.

fix

Ensure the number of placeholders matches the number of arguments after the SQL string.

SyntaxError: Unterminated string constant

Manual string concatenation without escaping quotes.

fix

Use placeholders instead: sql.append('SELECT * FROM users WHERE name = ?', name)

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

13 hits · last 30 days

node