SQL Assert

Assert identifiers (e.g. table/view names) before using them in SQL statements.

Installation

npm install sql-assert --save

Usage

Standalone

1import { simpleSqlName, qualifiedSqlName, noop } from "sql-assert";
2
3// returns a valid SQL name or throws an error
4const stmt1 = `select count(*) from ${simpleSqlName(tableName)}`;
5const stmt2 = `select count(*) from ${qualifiedSqlName(tableName)}`;
6
7// no operation, returns original value
8// SQL injection is possible, e.g., if `tableName` is a function parameter
9const stmt3 = `select count(*) from ${noop(tableName)}`;

With sql-template-tag

1import sql, { raw } from "sql-template-tag";
2import { simpleSqlName, qualifiedSqlName } from "sql-assert";
3
4// throws an error if tableName or columnName is not syntactically valid
5// columnValue is a bind variable, hence no SQL injection is possible
6const query = sql`select count(*) 
7                    from ${raw(qualifiedSqlName(tableName))} 
8                   where ${raw(simpleSqlName(columnName))} = ${columnValue}`;

License

sql-assert is licensed under the Apache License, Version 2.0. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.