Back to Explore

mysqljs/sql-escaper

GitHub
1 updates · last 90 daysOpen source

Last release:

SQL Escaper is a JavaScript (Node.js, Bun, Deno) library for escaping values, identifiers, and formatting SQL queries. It provides functions like escape, escapeId, format, and raw, using an AST-based approach that keeps the same API as the older sqlstring while aiming to address a potential SQL injection issue.

Project status

  • The source appears actively maintained, with its latest update on September 14, 2026, about six weeks ago.
  • Updates are irregular and often clustered: several arrived in July, after a smaller burst in February.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v1.5.2

    v1.5.2 is a small maintenance release that claims to address Node.js 12 compatibility. The code change that likely enables Node 12 support is an update to how Buffer is imported in the package entrypoint.

  • v1.5.1

    v1.5.1 primarily changes how the library models Temporal values, aiming to make the exported TemporalValue type self-contained without requiring the TS ESNext.Temporal lib. The diff also includes minor runtime guard tightening and several tooling and dev dependency updates.

    Breaking

  • v1.5.0

    v1.5.0 adds support for escaping JavaScript Temporal values by extending the input types accepted by `escape` and introducing a dedicated conversion path. The release notes only mention the Temporal feature at a high level, while the code changes also add new exports and include multiple dev/tooling configuration updates.

    Features

  • v1.4.0

    v1.4.0 adds Set and Map support for `?` placeholder expansion, and improves SQL parsing around `SET` clauses in multi-statement queries. It also refines placeholder substitution near tricky comment syntaxes (like non-comment `--` and executable comments) and includes a performance improvement to how `SET` clauses are scanned.

    Features

  • v1.3.3

    Release v1.3.3 is a targeted bug fix intended to prevent SQL comment parsing from interfering with delimiter handling. The code changes add explicit support for backtick-quoted identifiers so that comment-like sequences inside backticks (for example, `--` and `/* ... */`) are not misinterpreted as SQL comments.

  • v1.3.2

    Release v1.3.2 includes a single bug fix related to how sql-escaper expands object parameters when used with INSERT ... SET ? ... ON DUPLICATE KEY UPDATE ?. The fix adjusts internal SQL keyword scanning so object expansion occurs in the correct section of the statement.

  • v1.3.1

    v1.3.1 is a small bug fix release focused on how `sql-escaper` treats object values when the `stringifyObjects` argument is falsy. The diff shows a targeted change in the main formatting logic, plus added tests to cover object injection resistance.

  • v1.3.0

    Release v1.3.0 primarily migrates the project under the `mysqljs` GitHub organization. The code diff shows mostly repository metadata, documentation, and publishing automation changes, with no visible changes to the library runtime API or implementation.

  • v1.2.0

    v1.2.0 adds SQL escaping support for `BigInt` and `Uint8Array`. It also includes a bug fix to preserve JSON path expressions when escaping identifiers.

    Features

  • v1.1.2

    v1.1.2 contains a focused bug fix around how sql-escaper expands object placeholders in SET-related clauses. The code changes tighten the conditions under which object expansion happens, and add logic to correctly handle cases where the word SET appears as a column name.