@@ -29,9 +29,9 @@ pg-promise
29
29
* [ Testing] ( #testing )
30
30
* [ Usage] ( #usage )
31
31
- [ Queries and Parameters] ( #queries-and-parameters )
32
+ - [ SQL Names] ( #sql-names )
32
33
- [ Raw Text] ( #raw-text )
33
- - [ Open Values] ( #open-values )
34
- - [ SQL Names] ( #sql-names )
34
+ - [ Open Values] ( #open-values )
35
35
- [ Query Result Mask] ( #query-result-mask )
36
36
- [ Named Parameters] ( #named-parameters )
37
37
- [ Conversion Helpers] ( #conversion-helpers )
@@ -166,6 +166,41 @@ serialized into JSON, the same as calling method `pgp.as.json()`, except the lat
166
166
167
167
For the latest SQL formatting support see method [as.format]
168
168
169
+ ### SQL Names
170
+
171
+ When a variable ends with `~` (tilde) or `:name`, it represents an SQL name or identifier, which must be a text
172
+ string of at least 1 character long. Such name is then properly escaped and wrapped in double quotes.
173
+
174
+ ```js
175
+ query('INSERT INTO $1~($2~) VALUES(...)', ['Table Name', 'Column Name']);
176
+ // => INSERT INTO "Table Name"("Column Name") VALUES(...)
177
+
178
+ // A mixed example for a dynamic column list:
179
+ var columns = ['id', 'message'];
180
+ query('SELECT ${columns^ } FROM ${table~ }' , {
181
+ columns: columns.map(pgp.as.name).join(),
182
+ table: ' Table Name'
183
+ });
184
+ //=> SELECT "id","message" FROM "Table Name"
185
+ ```
186
+
187
+ Version 5.2.1 and later supports extended syntax for `${this~}` and for method [as.name]:
188
+
189
+ ```js
190
+ var obj = {
191
+ one: 1,
192
+ two: 2
193
+ };
194
+
195
+ format("INSERT INTO table(${this~}) VALUES(${one}, ${two})", obj);
196
+ //=>INSERT INTO table("one","two") VALUES(1, 2)
197
+ ```
198
+
199
+ Relying on this type of formatting for sql names and identifiers, along with regular variable formatting
200
+ makes your application impervious to sql injection.
201
+
202
+ See method [as.name] for the latest API.
203
+
169
204
### Raw Text
170
205
171
206
Raw-text values can be injected by ending the variable name with `^` or `:raw`:
@@ -211,41 +246,6 @@ query("...WHERE name LIKE '%${filter:value}'", {filter: "O'Connor"});
211
246
212
247
See also: method [as.value].
213
248
214
- ### SQL Names
215
-
216
- When a variable ends with ` ~` (tilde) or ` :name` , it represents an SQL name or identifier, which must be a text
217
- string of at least 1 character long . Such name is then properly escaped and wrapped in double quotes.
218
-
219
- ` ` ` js
220
- query('INSERT INTO $1~($2~) VALUES(...)', ['Table Name', 'Column Name']);
221
- //=> INSERT INTO "Table Name"("Column Name") VALUES(...)
222
-
223
- // A mixed example for a dynamic column list:
224
- var columns = ['id', 'message'];
225
- query('SELECT ${ columns^ } FROM ${ table~ } ', {
226
- columns: columns.map(pgp.as.name).join(),
227
- table: 'Table Name'
228
- });
229
- //=> SELECT "id","message" FROM "Table Name"
230
- ` ` `
231
-
232
- Version 5.2 .1 and later supports extended syntax for ` ${ this ~ } ` and for method [as .name ]:
233
-
234
- ` ` ` js
235
- var obj = {
236
- one: 1,
237
- two: 2
238
- };
239
-
240
- format("INSERT INTO table(${ this ~ } ) VALUES(${ one} , ${ two} )", obj);
241
- //=>INSERT INTO table("one","two") VALUES(1, 2)
242
- ` ` `
243
-
244
- Relying on this type of formatting for sql names and identifiers, along with regular variable formatting
245
- makes your application impervious to sql injection.
246
-
247
- See method [as .name ] for the latest API .
248
-
249
249
## Query Result Mask
250
250
251
251
In order to eliminate the chances of unexpected query results and thus make the code more robust,
0 commit comments