SQL Template Tag

ES2015 tagged template string for preparing SQL statements.

Installation

npm install sql-template-tag --save

Usage

1import sql, { empty, join, raw } from "sql-template-tag";
2
3const query = sql`SELECT * FROM books WHERE id = ${id}`;
4
5query.sql; //=> "SELECT * FROM books WHERE id = ?"
6query.text; //=> "SELECT * FROM books WHERE id = $1"
7query.statement; //=> "SELECT * FROM books WHERE id = :1"
8query.values; //=> [id]
9
10pg.query(query); // Uses `text` and `values`.
11mysql.query(query); // Uses `sql` and `values`.
12oracledb.execute(query); // Uses `statement` and `values`.
13
14// Embed SQL instances inside SQL instances.
15const nested = sql`SELECT id FROM authors WHERE name = ${"Blake"}`;
16const query = sql`SELECT * FROM books WHERE author_id IN (${nested})`;
17
18// Join and "empty" helpers (useful for nested queries).
19sql`SELECT * FROM books ${hasIds ? sql`WHERE ids IN (${join(ids)})` : empty}`;

Join

Accepts an array of values or SQL, and returns SQL with the values joined together using the separator.

1const query = join([1, 2, 3]);
2
3query.sql; //=> "?,?,?"
4query.values; //=> [1, 2, 3]

Tip: You can set the second argument to change the join separator, for example:

1join(
2  [sql`first_name LIKE ${firstName}`, sql`last_name LIKE ${lastName}`],
3  " AND ",
4); // => "first_name LIKE ? AND last_name LIKE ?"

Raw

Accepts a string and returns a SQL instance, useful if you want some part of the SQL to be dynamic.

1raw("SELECT"); // == sql`SELECT`

Do not accept user input to raw, this will create a SQL injection vulnerability.

Empty

Simple placeholder value for an empty SQL string. Equivalent to raw("").

Bulk

Accepts an array of arrays, and returns the SQL with the values joined together in a format useful for bulk inserts.

1const query = sql`INSERT INTO users (name) VALUES ${bulk([
2  ["Blake"],
3  ["Bob"],
4  ["Joe"],
5])}`;
6
7query.sql; //=> "INSERT INTO users (name) VALUES (?),(?),(?)"
8query.values; //=> ["Blake", "Bob", "Joe"]

Recipes

This package "just works" with pg, mysql, sqlite and oracledb.

MSSQL

1mssql.query(query.strings, ...query.values);

Stricter TypeScript

The default value is unknown to support every possible input. If you want stricter TypeScript values you can create a new sql template tag function.

1import { Sql } from "sql-template-tag";
2
3type SupportedValue =
4  | string
5  | number
6  | SupportedValue[]
7  | { [key: string]: SupportedValue };
8
9function sql(
10  strings: ReadonlyArray<string>,
11  ...values: Array<SupportedValue | Sql>
12) {
13  return new Sql(strings, values);
14}

Related

Some other modules exist that do something similar:

• sql-template-strings: promotes mutation via chained methods and lacks nesting SQL statements. The idea to support sql and text properties for dual mysql and pg compatibility came from here.
• pg-template-tag: missing TypeScript and MySQL support. This is the API I envisioned before writing this library, and by supporting pg only it has the ability to dedupe values.

License

MIT