node-postgres how to escape parameters?

Question

I know about parameterized query, but since I have to programmatically construct the where condition, taking count of the parameters and building the parameters array is a task much more complex than simply calling an escape function when required. So:

is there a parameters escape function in node-postgres?

Constructing a values array dynamically isn't that hard. Or consider using an ORM that does this for you? — Bergi
– Bergi, Commented Jan 2, 2022 at 14:02

Bergi · Accepted Answer · 2023-09-11 12:24:59Z

11

Yes, since this PR there are client.escapeIdentifier and client.escapeLiteral ~~(sadly still undocumented)~~, and since PR2954 (released with v8.11.0) they are exported and documented as pg.escapeIdentifier and pg.escapeLiteral.

However, it is not recommended to use them when you can use parameterised queries, and for dynamic WHERE condition you can easily construct a query object with text and values on the fly.

edited Sep 11, 2023 at 12:24

answered Jan 2, 2022 at 14:11

Bergi

671k162 gold badges1k silver badges1.5k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Daniele Ricci Over a year ago

client.escapeLiteral is the answer I was looking for; the fact it is undocumented makes clear why I wasn't able to find it. Thank you.

Collectives™ on Stack Overflow

node-postgres how to escape parameters?

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related