tsqlstring

library1.0.1jsnpmunverified

Simple SQL escape and format library for T-SQL (Microsoft SQL Server), currently at version 1.0.1. Inspired by the popular sqlstring library for MySQL, tsqlstring provides functions to safely escape values and format queries using placeholders. It supports numbers, booleans, dates, buffers, strings, arrays, nested arrays, objects with toSqlString method, and null/undefined. Notably, it does not support NaN or Infinity as T-SQL lacks support for these. The library is released under the MIT license and is actively maintained.

database

npm install tsqlstring

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · TSQLSTRING

tsqlstring

databasejavascriptv1.0.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import SqlString from 'tsqlstring'

✗ const SqlString = require('tsqlstring')

ESM default import works; CommonJS require also works.

escape

✓ import { escape } from 'tsqlstring'

✗ import SqlString from 'tsqlstring'; const { escape } = SqlString

Named export available; direct import avoids destructuring.

format

✓ import { format } from 'tsqlstring'

✗ import format from 'tsqlstring'

format is a named export, not default.

Demonstrates escaping user input with placeholders and direct escape to prevent SQL injection.

import SqlString from 'tsqlstring'; const userId = 1; const sql = SqlString.format('SELECT * FROM users WHERE id = ?', [userId]); console.log(sql); // SELECT * FROM users WHERE id = 1 const userInput = 'O\"Brien'; const escaped = SqlString.escape(userInput); console.log(escaped); // 'O\"Brien'

Debug

Known issues

gotchaNaN and Infinity are not escaped and left as-is, which may cause SQL Server errors.

fix

Ensure values are not NaN or Infinity before passing to escape; convert to NULL if needed.

affects: *

gotchaThe format function only replaces ? placeholders, not named placeholders like @p1.

fix

Use ? placeholders exclusively when using format; for named parameters, use manual escaping.

affects: *

gotchaPlaceholders inside comments or strings are still replaced, which may break SQL queries.

fix

Avoid using ? in comments or string literals; escape literal ? if needed.

affects: *

Errors

Common errors & fixes

TypeError: SqlString.escape is not a function

Importing module incorrectly or using default export as object.

fix

Use correct import: import SqlString from 'tsqlstring' or const SqlString = require('tsqlstring')

Cannot find module 'tsqlstring'

Package not installed or typo in package name.

fix

Run: npm install tsqlstring

SqlString.format is not a function

Using named import incorrectly; format is a named export.

fix

Use: import { format } from 'tsqlstring'

Upgrade

Version history

1.0.1latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

17 hits · last 30 days

node