Registry / database / sql-template-builder

sql-template-builder

library1.0.5jsnpmunverified

Complex SQL query builder library (v1.0.5) using ES6 tagged template literals. Enables building parameterized SQL queries with automatic placeholder substitution for PostgreSQL ($1, $2) and MySQL (?, ?). Ships as CommonJS with Node >=14 support. Key differentiator: supports nested template parts, raw values, custom join strings, and prepared statement naming. Lighter than knex but less feature-rich; focused on dynamic query composition for pg, mysql, mysql2, and sequelize.

database

npm install sql-template-builder

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQL-TEMPLATE-BUILD

sql-template-builder

databasejavascriptv1.0.5

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (sql function)

✓ const sql = require('sql-template-builder');

✗ import sql from 'sql-template-builder';

Package is CommonJS only; ESM import will fail with SyntaxError.

sql`` template tag

✓ sql`SELECT * FROM ${table}`;

✗ sql(`SELECT * FROM ${table}`);

Must use template literal syntax, not function call. Using parentheses will evaluate the template before sql can process placeholders.

sql.raw()

✓ sql.raw('my_table');

✗ sql`my_table`

Use sql.raw() only when you need to bypass placeholder escaping (e.g., table names). sql`my_table` treats content as a safe template part; sql.raw('my_table') emits raw text without escaping – SQL injection risk if user input.

Simple parameterized SELECT query using pg pool and sql-template-builder.

Debug

Known issues

gotchaDo not use template literal parentheses: sql(`SELECT ${col}`). This evaluates the template immediately, bypassing placeholder extraction.

fix

Use template literal backticks: sql`SELECT ${col}`.

affects: >=1.0.0

gotchasql.raw() emits SQL without escaping. Passing unsanitized user input creates SQL injection vulnerabilities.

fix

Only pass trusted strings to sql.raw(). For dynamic identifiers, prefer sql`${identifier}` (safely quoted).

affects: >=1.0.0

gotchaPlaceholder indexing issues when using .setName() with PostgreSQL: placeholders are re-indexed starting from $1 (not continued from previous parts).

fix

Use .setName() on the final query only; do not rely on placeholder order across multiple .setName() calls.

affects: >=1.0.0

deprecatedTravis CI badge and config is present but Travis CI no longer provides free builds for public repos.

fix

Replace CI with GitHub Actions; ignore badge.

affects: >=0.0.0

Errors

Common errors & fixes

SyntaxError: Unexpected token '`'

Node.js version <14 does not support template literal tags.

fix

Upgrade Node.js to >=14.0.0.

TypeError: sql is not a function

Importing named export instead of default.

fix

Use `const sql = require('sql-template-builder')` (CommonJS) instead of destructured import.

Error: Placeholder index 0 is out of range

Using .setName() on a query with named placeholders that conflict with previous placeholder numbering.

fix

Call .setName() only on the final query after all parts have been composed.

Upgrade

Version history

1.0.5latest on npm

Audit

Dependencies

pgoptionalCommon runtime target for parameterized queries with PostgreSQL placeholder style ($1, $2)

mysqloptionalCommon runtime target for parameterized queries with MySQL placeholder style (?)

mysql2optionalCommon runtime target for parameterized queries with MySQL2 placeholder style (?)

sequelizeoptionalCommon runtime target for parameterized queries with Sequelize integration

Agent activity

7 hits · last 30 days

node