Skip to content

Commit f21e072

Browse files
committed
docs.
1 parent 16b9541 commit f21e072

File tree

1 file changed

+37
-37
lines changed

1 file changed

+37
-37
lines changed

README.md

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ pg-promise
2929
* [Testing](#testing)
3030
* [Usage](#usage)
3131
- [Queries and Parameters](#queries-and-parameters)
32+
- [SQL Names](#sql-names)
3233
- [Raw Text](#raw-text)
33-
- [Open Values](#open-values)
34-
- [SQL Names](#sql-names)
34+
- [Open Values](#open-values)
3535
- [Query Result Mask](#query-result-mask)
3636
- [Named Parameters](#named-parameters)
3737
- [Conversion Helpers](#conversion-helpers)
@@ -166,6 +166,41 @@ serialized into JSON, the same as calling method `pgp.as.json()`, except the lat
166166

167167
For the latest SQL formatting support see method [as.format]
168168

169+
### SQL Names
170+
171+
When a variable ends with `~` (tilde) or `:name`, it represents an SQL name or identifier, which must be a text
172+
string of at least 1 character long. Such name is then properly escaped and wrapped in double quotes.
173+
174+
```js
175+
query('INSERT INTO $1~($2~) VALUES(...)', ['Table Name', 'Column Name']);
176+
//=> INSERT INTO "Table Name"("Column Name") VALUES(...)
177+
178+
// A mixed example for a dynamic column list:
179+
var columns = ['id', 'message'];
180+
query('SELECT ${columns^} FROM ${table~}', {
181+
columns: columns.map(pgp.as.name).join(),
182+
table: 'Table Name'
183+
});
184+
//=> SELECT "id","message" FROM "Table Name"
185+
```
186+
187+
Version 5.2.1 and later supports extended syntax for `${this~}` and for method [as.name]:
188+
189+
```js
190+
var obj = {
191+
one: 1,
192+
two: 2
193+
};
194+
195+
format("INSERT INTO table(${this~}) VALUES(${one}, ${two})", obj);
196+
//=>INSERT INTO table("one","two") VALUES(1, 2)
197+
```
198+
199+
Relying on this type of formatting for sql names and identifiers, along with regular variable formatting
200+
makes your application impervious to sql injection.
201+
202+
See method [as.name] for the latest API.
203+
169204
### Raw Text
170205
171206
Raw-text values can be injected by ending the variable name with `^` or `:raw`:
@@ -211,41 +246,6 @@ query("...WHERE name LIKE '%${filter:value}'", {filter: "O'Connor"});
211246
212247
See also: method [as.value].
213248
214-
### SQL Names
215-
216-
When a variable ends with `~` (tilde) or `:name`, it represents an SQL name or identifier, which must be a text
217-
string of at least 1 character long. Such name is then properly escaped and wrapped in double quotes.
218-
219-
```js
220-
query('INSERT INTO $1~($2~) VALUES(...)', ['Table Name', 'Column Name']);
221-
//=> INSERT INTO "Table Name"("Column Name") VALUES(...)
222-
223-
// A mixed example for a dynamic column list:
224-
var columns = ['id', 'message'];
225-
query('SELECT ${columns^} FROM ${table~}', {
226-
columns: columns.map(pgp.as.name).join(),
227-
table: 'Table Name'
228-
});
229-
//=> SELECT "id","message" FROM "Table Name"
230-
```
231-
232-
Version 5.2.1 and later supports extended syntax for `${this~}` and for method [as.name]:
233-
234-
```js
235-
var obj = {
236-
one: 1,
237-
two: 2
238-
};
239-
240-
format("INSERT INTO table(${this~}) VALUES(${one}, ${two})", obj);
241-
//=>INSERT INTO table("one","two") VALUES(1, 2)
242-
```
243-
244-
Relying on this type of formatting for sql names and identifiers, along with regular variable formatting
245-
makes your application impervious to sql injection.
246-
247-
See method [as.name] for the latest API.
248-
249249
## Query Result Mask
250250
251251
In order to eliminate the chances of unexpected query results and thus make the code more robust,

0 commit comments

Comments
 (0)