sqlutils

library1.5.4jsnpmunverified

Lightweight SQL helper library (v1.5.4) providing escape and format utilities for MySQL and PostgreSQL. Uses sqlstring under the hood for MySQL (same as mysql2) and pg-promise for PostgreSQL. Offers consistent API across both dialects, supporting parameterized queries, array/object insertion, and raw value interpolation. Released under MIT license, maintained on GitHub.

database

npm install sqlutils

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SQLUTILS

sqlutils

databasejavascriptv1.5.4

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

escape (PostgreSQL)

✓ import escape from 'sqlutils/pg/escape';

✗ const escape = require('sqlutils/pg/escape'); // still works but not ESM

Also importable via 'sqlutils/pg' as named export: const { escape } = require('sqlutils/pg');

escape (MySQL)

✓ import escape from 'sqlutils/mysql/escape';

✗ const escape = require('sqlutils/mysql/escape'); // CommonJS, works but not ESM

Also importable via 'sqlutils/mysql' named export.

format (PostgreSQL)

✓ import format from 'sqlutils/pg/format';

✗ import { format } from 'sqlutils/pg'; // 'format' is not exported from 'sqlutils/pg', use default import

Must import from subpath 'sqlutils/pg/format' or default import of 'sqlutils/pg'.

Shows how to escape a string for PostgreSQL and format an INSERT query with an object for MySQL.

// PostgreSQL escape example import escape from 'sqlutils/pg/escape'; console.log(escape("let's do it")); // 'let''s do it' // MySQL format example import format from 'sqlutils/mysql/format'; const sql = format('INSERT INTO customers ?', { name: 'John Doe', balance: 0 }); console.log(sql); // INSERT INTO customers (name, balance) VALUES ('John Doe', 0)

Debug

Known issues

breakingThe package does not export a top-level index; all imports must use subpaths like 'sqlutils/pg/escape' or 'sqlutils/mysql'.

fix

Use correct import path: import from 'sqlutils/pg/format' not 'sqlutils'.

affects: >=1.0.0

gotchaThe format function uses '?' as placeholder for objects/arrays, not '?' for values. To insert a value, use '?' with a single value? Actually '?' is for objects/arrays. For escaped values, use the escape function separately.

fix

Use `format('... ?', obj)` for object insertion; for single values, use escape or pg-promise's native formatting.

affects: >=1.0.0

gotchaWhen using '!key' prefix in format, the value is inserted raw (unescaped). This can lead to SQL injection if user input is passed.

fix

Only use '!key' with trusted constants; for user input, use regular keys.

affects: >=1.0.0

gotchaThe buildWhereFromQuery function is only available for PostgreSQL subpath 'sqlutils/pg'.

fix

Check MySQL documentation; buildWhereFromQuery may not be available for MySQL.

affects: >=1.0.0

Errors

Common errors & fixes

Cannot find module 'sqlutils'

Top-level import doesn't exist; must use subpath.

fix

Use 'sqlutils/pg' or 'sqlutils/mysql' instead.

format is not a function

Importing 'format' from wrong path (e.g., 'sqlutils/pg' instead of 'sqlutils/pg/format').

fix

Use `import format from 'sqlutils/pg/format'` or default import from subpath.

Cannot read property 'escape' of undefined

Using `require('sqlutils').escape` which doesn't exist.

fix

Use `require('sqlutils/pg/escape')` or destructure from subpath.

Upgrade

Version history

1.5.4latest on npm

Audit

Dependencies

sqlstringrequiredused for MySQL escape/format

pg-promiserequiredused for PostgreSQL escape/format

Agent activity

9 hits · last 30 days

node