{"id":43989,"library":"sqlstring","title":"sqlstring","description":"Simple SQL escape and format utility for MySQL, commonly used as a dependency of mysqljs/mysql and mysql2. The current stable version is 2.3.3, with a stable release cadence (last updated 2020). It provides escape() and format() methods for safe SQL value interpolation, supporting custom toSqlString for raw SQL fragments. Unlike template-based libraries, it uses placeholder substitution (?), but does NOT protect against all injection vectors (e.g., NO_BACKSLASH_ESCAPES mode). Lightweight, no dependencies, and compatible with Node >= 0.6.","status":"active","version":"2.3.3","language":"javascript","source_language":"en","source_url":"https://github.com/mysqljs/sqlstring","tags":["javascript","sqlstring","sql","escape","sql escape"],"install":[{"cmd":"npm install sqlstring","lang":"bash","label":"npm"},{"cmd":"yarn add sqlstring","lang":"bash","label":"yarn"},{"cmd":"pnpm add sqlstring","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"Default import for ESM; the package is CJS-only so ESM usage requires a bundler or Node >= 16 with --experimental-modules.","wrong":"const { escape } = require('sqlstring')","symbol":"SqlString","correct":"import SqlString from 'sqlstring'"},{"note":"escape is a method on the default export, not a named export.","wrong":"import { escape } from 'sqlstring'","symbol":"escape","correct":"import SqlString from 'sqlstring';\nSqlString.escape(value)"},{"note":"format is a static method; require('sqlstring') returns the same default object.","wrong":"const { format } = require('sqlstring')","symbol":"format","correct":"import SqlString from 'sqlstring';\nSqlString.format(sql, values)"},{"note":"raw returns an object with toSqlString method; usable as a placeholder value.","wrong":"const raw = require('sqlstring').raw('...')","symbol":"raw","correct":"import SqlString from 'sqlstring';\nconst raw = SqlString.raw('CURRENT_TIMESTAMP()');"}],"quickstart":{"code":"import SqlString from 'sqlstring';\n\nconst userId = \"1' OR '1'='1\";\nconst safeSQL = 'SELECT * FROM users WHERE id = ' + SqlString.escape(userId);\nconsole.log(safeSQL); // SELECT * FROM users WHERE id = '1\\' OR \\'1\\'=\\'1'\n\nconst post = { id: 1, title: 'Hello MySQL' };\nconst insertSQL = SqlString.format('INSERT INTO posts SET ?', post);\nconsole.log(insertSQL); // INSERT INTO posts SET `id` = 1, `title` = 'Hello MySQL'\n\nconst now = SqlString.raw('CURRENT_TIMESTAMP()');\nconst updateSQL = SqlString.format('UPDATE posts SET modified = ? WHERE id = ?', [now, 1]);\nconsole.log(updateSQL); // UPDATE posts SET modified = CURRENT_TIMESTAMP() WHERE id = 1","lang":"typescript","description":"Demonstrates escape, format, and raw usage for safe SQL value interpolation and raw SQL fragments."},"warnings":[{"fix":"Ensure MySQL server runs with NO_BACKSLASH_ESCAPES disabled, or use parameterized queries with mysql2 prepared statements.","message":"Escape methods assume NO_BACKSLASH_ESCAPES SQL mode is OFF; if enabled, backslash escapes become invalid, leading to potential SQL injection.","severity":"gotcha","affected_versions":">=0.0.1"},{"fix":"Avoid using '?' inside comment blocks or string literals; escape literal '?' or use alternative methods.","message":"Placeholder '?' replacement happens even inside SQL comments and string literals, which can break queries if placeholders appear in those contexts.","severity":"gotcha","affected_versions":">=0.0.1"},{"fix":"Use mysql2's escape() or migrate to a maintained alternative like @mysql2/promise.","message":"Package is stable but rarely updated; last release was in 2020. Consider using mysql2's built-in escape or an ORM for active maintenance.","severity":"deprecated","affected_versions":"2.3.3"},{"fix":"Validate numeric inputs to reject NaN/Infinity before passing to escape/format.","message":"NaN and Infinity values are left as-is and passed to MySQL, causing runtime errors as MySQL does not support these literals.","severity":"gotcha","affected_versions":">=0.0.1"},{"fix":"Ensure objects used with escape/format have only serializable values.","message":"Object properties with function values are silently skipped, which may lead to unexpected omissions when escaping objects.","severity":"gotcha","affected_versions":">=0.0.1"}],"env_vars":null,"search_vec":"'0.6':80 '2.3.3':24 '2020':32 'backslash':70 'base':54 'cadenc':29 'common':10 'compat':77 'current':20 'custom':45 'depend':14,75 'e.g':68 'escap':4,35,71,84,86 'format':6,37 'fragment':50 'inject':66 'interpol':43 'javascript':81 'last':30 'librari':55 'lightweight':73 'method':38 'mode':72 'mysql':9 'mysql2':18 'mysqljs/mysql':16 'node':79 'placehold':58 'protect':63 'provid':34 'raw':48 'releas':28 'safe':40 'simpl':2 'sql':3,41,49,83,85 'sqlstring':1,82 'stabl':21,27 'substitut':59 'support':44 'templat':53 'template-bas':52 'tosqlstr':46 'unlik':51 'updat':31 'use':11,57 'util':7 'valu':42 'vector':67 'version':22","created_at":"2026-06-05T17:02:26.610735+00:00","updated_at":"2026-06-05T17:02:26.610735+00:00","problems":[{"fix":"Use default import: `import SqlString from 'sqlstring'` then call `SqlString.escape(value)`.","cause":"Named import instead of default import: `import { escape } from 'sqlstring'`","error":"TypeError: SqlString.escape is not a function"},{"fix":"Require correctly: `const SqlString = require('sqlstring');` or default import in ESM.","cause":"Calling `SqlString.escape()` after importing the module incorrectly (e.g., destructuring) or without initialization.","error":"Cannot read properties of undefined (reading 'escape')"},{"fix":"Use `SqlString.raw('...')` to create an object with toSqlString method.","cause":"Passing a raw object without toSqlString method to format placeholder; misusing SqlString.raw.","error":"TypeError: (value).toSqlString is not a function"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/mysqljs/sqlstring#readme","github":"https://github.com/mysqljs/sqlstring","docs":null,"changelog":null,"pypi":null,"npm":"sqlstring","openapi_spec":null,"status_page":null,"smithery":null,"categories":["database"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-05","next_check":"2026-09-03","install_tag":null}}