Gathering detailed insights and metrics for sql-template-tag
Gathering detailed insights and metrics for sql-template-tag
Gathering detailed insights and metrics for sql-template-tag
Gathering detailed insights and metrics for sql-template-tag
@flowblade/sql-tag
Raw sql template literal
@wzrdtales/sql-template-tag
ES2015 tagged template string for preparing SQL statements, works with `pg` and `mysql`
eslint-plugin-sql-template
ESLint plugin with rules for using the `sql` template tag on raw SQL queries
sql-tag
A template tag for writing elegant sql strings
ES2015 tagged template string for preparing SQL statements, works with `pg`, `mysql`, `sqlite` and `oracledb`
npm install sql-template-tag
Typescript
Module System
Min. Node Version
Node Version
NPM Version
98.9
Supply Chain
100
Quality
76
Maintenance
100
Vulnerability
100
License
Documentation: Native OracleDB support
Updated on Apr 20, 2024
OracleDB support
Updated on Nov 28, 2023
Bulk method and readonly input types
Updated on Sep 04, 2023
Set `Value` type to `unknown`
Updated on May 27, 2022
Performance improvements
Updated on May 13, 2022
Allow `Date` as value type
Updated on Jan 31, 2022
TypeScript (100%)
Total Downloads
3,039,329
Last Day
262
Last Week
29,697
Last Month
133,688
Last Year
1,369,282
MIT License
379 Stars
88 Commits
18 Forks
3 Watchers
4 Branches
7 Contributors
Updated on Jun 06, 2025
Latest Version
5.2.1
Package Id
sql-template-tag@5.2.1
Unpacked Size
20.35 kB
Size
5.85 kB
File Count
6
NPM Version
10.5.0
Node Version
20.12.1
Published on
Apr 20, 2024
Cumulative downloads
Total Downloads
Last Day
0.4%
262
Compared to previous day
Last Week
-4.5%
29,697
Compared to previous week
Last Month
-6.4%
133,688
Compared to previous month
Last Year
94.1%
1,369,282
Compared to previous year
ES2015 tagged template string for preparing SQL statements.
npm install sql-template-tag --save
1import sql, { empty, join, raw } from "sql-template-tag"; 2 3const query = sql`SELECT * FROM books WHERE id = ${id}`; 4 5query.sql; //=> "SELECT * FROM books WHERE id = ?" 6query.text; //=> "SELECT * FROM books WHERE id = $1" 7query.statement; //=> "SELECT * FROM books WHERE id = :1" 8query.values; //=> [id] 9 10pg.query(query); // Uses `text` and `values`. 11mysql.query(query); // Uses `sql` and `values`. 12oracledb.execute(query); // Uses `statement` and `values`. 13 14// Embed SQL instances inside SQL instances. 15const nested = sql`SELECT id FROM authors WHERE name = ${"Blake"}`; 16const query = sql`SELECT * FROM books WHERE author_id IN (${nested})`; 17 18// Join and "empty" helpers (useful for nested queries). 19sql`SELECT * FROM books ${hasIds ? sql`WHERE ids IN (${join(ids)})` : empty}`;
Accepts an array of values or SQL, and returns SQL with the values joined together using the separator.
1const query = join([1, 2, 3]); 2 3query.sql; //=> "?,?,?" 4query.values; //=> [1, 2, 3]
Tip: You can set the second argument to change the join separator, for example:
1join( 2 [sql`first_name LIKE ${firstName}`, sql`last_name LIKE ${lastName}`], 3 " AND ", 4); // => "first_name LIKE ? AND last_name LIKE ?"
Accepts a string and returns a SQL instance, useful if you want some part of the SQL to be dynamic.
1raw("SELECT"); // == sql`SELECT`
Do not accept user input to raw
, this will create a SQL injection vulnerability.
Simple placeholder value for an empty SQL string. Equivalent to raw("")
.
Accepts an array of arrays, and returns the SQL with the values joined together in a format useful for bulk inserts.
1const query = sql`INSERT INTO users (name) VALUES ${bulk([ 2 ["Blake"], 3 ["Bob"], 4 ["Joe"], 5])}`; 6 7query.sql; //=> "INSERT INTO users (name) VALUES (?),(?),(?)" 8query.values; //=> ["Blake", "Bob", "Joe"]
This package "just works" with pg
, mysql
, sqlite
and oracledb
.
1mssql.query(query.strings, ...query.values);
The default value is unknown
to support every possible input. If you want stricter TypeScript values you can create a new sql
template tag function.
1import { Sql } from "sql-template-tag";
2
3type SupportedValue =
4 | string
5 | number
6 | SupportedValue[]
7 | { [key: string]: SupportedValue };
8
9function sql(
10 strings: ReadonlyArray<string>,
11 ...values: Array<SupportedValue | Sql>
12) {
13 return new Sql(strings, values);
14}
Some other modules exist that do something similar:
sql-template-strings
: promotes mutation via chained methods and lacks nesting SQL statements. The idea to support sql
and text
properties for dual mysql
and pg
compatibility came from here.pg-template-tag
: missing TypeScript and MySQL support. This is the API I envisioned before writing this library, and by supporting pg
only it has the ability to dedupe values
.MIT
No vulnerabilities found.
Reason
security policy file detected
Details
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
Reason
Found 3/30 approved changesets -- score normalized to 1
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Reason
16 existing vulnerabilities detected
Details
Score
Last Scanned on 2025-06-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More