sqltag

library1.1.0jsnpmunverified

SQL generation using ES6 tagged template strings. Provides safe parameterization and escaping for mysql, mysql2, and postgres drivers. Current version 1.1.0 is stable with no recent updates. Key differentiators: native template literal syntax, automatic value interpolation, built-in helpers for WHERE, SET, VALUES, raw/identifier escaping, and spread arrays. Lightweight with zero dependencies. Comparable to sql-template-strings but with a more concise API and fewer features.

database

npm install sqltag

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQLTAG

sqltag

databasejavascriptv1.1.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default (SQL)

✓ import SQL from 'sqltag';

✗ const SQL = require('sqltag');

ESM-only since v1.0.0; CommonJS require will return an object with a default property.

Named helpers (raw, ident, where, set, values, spread, op)

✓ import SQL, { raw, ident, where, set, values, spread, op } from 'sqltag';

All helpers are properties of the default export; destructuring works in both ESM and CJS if using require, but prefer ESM.

TypeScript (types not shipped)

✓ No TypeScript types available; use JSDoc or custom declarations.

Package does not include TypeScript definitions; users often wrongly assume @types/sqltag exists.

Shows ESM import, parameter interpolation, helpers (values, spread), and usage with mysql2.

import SQL from 'sqltag'; // Example with mysql2 (async/await) async function getUserById(id: number) { const sql = SQL`SELECT * FROM users WHERE id = ${id}`; // mysql.query(sql) returns the query and values return await connection.query(sql); } // Using helpers SQL`INSERT INTO users ${SQL.values({ name: 'Alice', age: 30 })}`; // Spread arrays SQL`SELECT * FROM users WHERE id IN (${SQL.spread([1, 2, 3])})`;

Debug

Known issues

gotchaDefault export is a template tag function, not a query builder. Passing the result directly to a database driver works because it returns an object with sql and values properties (mysql) or a query string (postgres).

fix

For mysql/mysql2, pass the tag result directly: connection.query(SQL`...`); For pg, same.

affects: >=1.0.0

breakingv1.0.0 changed from CommonJS to ESM-only. require() will not work as expected.

fix

Use import syntax or dynamic import: const SQL = (await import('sqltag')).default;

affects: >=1.0.0

deprecatedNo updates since 2019; the package is functionally complete but not actively maintained. Pull requests may not be merged.

fix

Consider alternatives like sql-template-strings or @databases/sql for active maintenance.

affects: >=1.0.0

gotchaUsing SQL.raw() inserts unescaped content; may lead to SQL injection if user input is passed directly.

fix

Only use SQL.raw() with trusted strings; never with user input.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: (0 , sqltag__WEBPACK_IMPORTED_MODULE_0__.default) is not a function

Using named import when the package has no named exports or using require() in ESM context.

fix

Use default import: import SQL from 'sqltag';

SQL is not a function

Using require('sqltag') in ESM environment; require returns a module object with default property.

fix

Use import SQL from 'sqltag'; or const SQL = require('sqltag').default;

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

17 hits · last 30 days

node