Registry / database / sql-tagged-template-literal

sql-tagged-template-literal

library1.3.0jsnpmunverified

An ES6 tagged template literal for escaping SQL query values, returning a sanitized SQL string. v1.3.0 supports values as MySQL-compatible escaped strings, with special handling for null/undefined (unquoted NULL), numbers (unquoted), booleans (text), objects (JSON-stringified and escaped), arrays and Sets (comma-separated), and 2D arrays for multi-row inserts. Lightweight wrapper around the mysqljs/sqlstring library. Unlike alternatives, it outputs a plain string rather than a custom query object, thus suited for simple dumps or direct query execution. Not intended for table/column name escaping.

database

npm install sql-tagged-template-literal

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQL-TAGGED-TEMPLAT

sql-tagged-template-literal

databasejavascriptv1.3.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (sql)

✓ import sql from 'sql-tagged-template-literal'

✗ const sql = require('sql-tagged-template-literal').default

ESM default export; no named exports. In CJS, use require('sql-tagged-template-literal') which returns the function directly.

sql

✓ const sql = require('sql-tagged-template-literal')

✗ const { sql } = require('sql-tagged-template-literal')

CJS import returns the function; destructuring yields undefined.

Type usage (TypeScript)

✓ import sql from 'sql-tagged-template-literal'

✗ import * as sql from 'sql-tagged-template-literal'

Package does not ship TypeScript types; use @types/sqlstring if needed. Default import is the only way.

Escapes a user-provided string value within a SQL INSERT query using a tagged template literal.

import sql from 'sql-tagged-template-literal'; const userInput = `Robert'); DROP TABLE Students;--`; const query = sql`INSERT INTO awesome_table (sweet_column) VALUES (${userInput})`; console.log(query); // => `INSERT INTO awesome_table (sweet_column) VALUES ('Robert\\'); DROP TABLE Students;--')`

Debug

Known issues

gotchaTagged template literals are not SQL-injection safe if you interpolate table or column names; they only escape values.

fix

Use a whitelist or other method to safely interpolate identifiers; never directly interpolate user input for names.

affects: >=1.0.0

gotchaObjects are JSON-stringified and escaped, which may produce unexpected output for non-JSON types or circular references.

fix

Ensure objects are JSON-serializable; avoid passing Date objects without explicit conversion; use custom serialization if needed.

affects: >=1.0.0

gotchaNull and undefined both become unquoted NULL, which is correct for SQL but may be confusing if you expect a different behavior.

fix

Pass string 'null' if you want the literal string, else accept that these map to SQL NULL.

affects: >=1.0.0

gotchaThe package depends on sqlstring for escaping, but sqlstring has no tagged template literal support; this package is a thin wrapper.

fix

No action needed unless sqlstring introduces vulnerabilities; watch for sqlstring updates.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: (intermediate value) is not a function

Incorrect import: using default import in CJS environment without proper transpilation.

fix

Use const sql = require('sql-tagged-template-literal'); (no .default).

ReferenceError: sql is not defined

Using template literal sql`...` without importing the function.

fix

Add import sql from 'sql-tagged-template-literal' or const sql = require('sql-tagged-template-literal').

Cannot find module 'sql-tagged-template-literal'

Package not installed.

fix

Run npm install sql-tagged-template-literal in your project directory.

Upgrade

Version history

1.3.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

17 hits · last 30 days

node