{"id":42709,"library":"escape-sql-string","title":"escape-sql-string","description":"A minimal SQL string escaping library to prevent SQL injection attacks. Current stable version is 1.2.2, with infrequent releases and no breaking changes expected. It provides a single function to escape single quotes and optionally backslashes, supporting both standard SQL (backslash not supported) and engines that do support backslash escapes. Ships TypeScript types. Key differentiator: simplicity and zero dependencies.","status":"active","version":"1.2.2","language":"javascript","source_language":"en","source_url":"git://github.com/jackall3n/escape-sql-string","tags":["javascript","sql","escape","injection","security","typescript"],"install":[{"cmd":"npm install escape-sql-string","lang":"bash","label":"npm"},{"cmd":"yarn add escape-sql-string","lang":"bash","label":"yarn"},{"cmd":"pnpm add escape-sql-string","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"Package is ESM-only; default export is a function. CommonJS require will fail unless using dynamic import or a bundler that handles ESM.","wrong":"const escapeString = require('escape-sql-string')","symbol":"escapeString","correct":"import escapeString from 'escape-sql-string'"},{"note":"Named import is incorrect because package exports a default function, not a named export. The function is the default export.","wrong":"import { escapeString } from 'escape-sql-string'","symbol":"(default) as any name","correct":"import myEscape from 'escape-sql-string'"},{"note":"When importing only the type, use 'import type' to avoid runtime inclusion. However, the exported type is not explicitly named; the function itself is callable.","wrong":"import { escapeString } from 'escape-sql-string'","symbol":"(type import)","correct":"import type escapeString from 'escape-sql-string'"}],"quickstart":{"code":"import escapeString from 'escape-sql-string';\n\nconst unsafe = \"O'Brien\";\nconst safe = escapeString(unsafe);\n// safe is \"'O''Brien'\"\nconsole.log(safe);\n\n// With backslash support\nconst safe2 = escapeString(unsafe, { backslashSupported: true });\n// safe2 is \"'O\\'Brien'\"\nconsole.log(safe2);","lang":"typescript","description":"Shows basic use of escapeString with default options and with backslash support enabled."},"warnings":[{"fix":"Set `{ backslashSupported: true }` if your SQL engine supports backslash escapes, or manually escape backslashes.","message":"Default escaping does not escape backslashes or double quotes, which may be unsafe for SQL engines that interpret backslashes.","severity":"gotcha","affected_versions":"<2.0.0"},{"fix":"Always pass a string to escapeString.","message":"The library does not validate input type; passing non-string values may cause runtime errors.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Consider using `sqlstring` or `mysql2`'s escaping functions for broader support.","message":"The package has not been updated in over 2 years; consider using more actively maintained alternatives.","severity":"deprecated","affected_versions":">=1.0.0"}],"env_vars":null,"search_vec":"'1.2.2':20 'attack':15 'backslash':40,45,53 'break':26 'chang':27 'current':16 'depend':63 'differenti':59 'engin':49 'escap':2,9,35,54,66 'escape-sql-str':1 'expect':28 'function':33 'infrequ':22 'inject':14,67 'javascript':64 'key':58 'librari':10 'minim':6 'option':39 'prevent':12 'provid':30 'quot':37 'releas':23 'secur':68 'ship':55 'simplic':60 'singl':32,36 'sql':3,7,13,44,65 'stabl':17 'standard':43 'string':4,8 'support':41,47,52 'type':57 'typescript':56,69 'version':18 'zero':62","created_at":"2026-06-05T16:56:17.146822+00:00","updated_at":"2026-06-05T16:56:17.146822+00:00","problems":[{"fix":"Use ES module import: `import escapeString from 'escape-sql-string'`.","cause":"Using CommonJS require incorrectly.","error":"TypeError: escapeString is not a function"},{"fix":"Set `\"type\": \"module\"` in package.json or use a bundler that supports ESM.","cause":"Trying to use the package in a CommonJS environment without transpilation.","error":"SyntaxError: Unexpected token 'export'"},{"fix":"Use `import escapeString from 'escape-sql-string'` instead of `import { escapeString } from 'escape-sql-string'`.","cause":"Named import instead of default import.","error":"ReferenceError: escapeString is not defined"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/jackall3n/escape-sql-string","github":"git://github.com/jackall3n/escape-sql-string","docs":null,"changelog":null,"pypi":null,"npm":"escape-sql-string","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-05","next_check":"2026-09-03","install_tag":null}}