-
-
Couldn't load subscription status.
- Fork 147
Description
db.query(sql`SET foo.bar TO ${foobar}`);throws syntax error at or near "$1". From what I understand, this is actually a limitation with PostgreSQL where not every statement supports prepared statements/parameter binding, so this isn't an issue in particular to Slonik.
However, the solutions I see elsewhere suggest using raw string interpolation, which is something that Slonik actively works to prevent (for good reason). And this inconsistency in Postgres breaks the abstraction for Slonik a bit...
This seems to work:
db.query(sql`SET foo.bar TO ${sql.indentifier([foobar.toString()])}`);But that doesn't feel like the proper use of indentifier and I don't know if I'm just getting lucky with my input so far.
So this is more of a question than a bug: what's the safest and least hacky way to do this from Slonik?
Expected Behavior
sql`SET some.var TO ${foobar}`works
Current Behavior
Error from underlying DB: syntax error at or near "$1"
Possible Solution
sql`SET some.var TO ${sql.someSanitzingFunction(foobar)}`I dunno... Right now the underlying PG library takes care of safely binding things, so it doesn't feel great to have to duplicate that in Slonik. Or is that what sql.identifier is doing? In that case, maybe just allow it to take a single argument as well as an array?
But I'm definitely not advocating enhancing sql to be aware of the query within it to determine if it supports binding. This is enough of an edge case that the programmer should be expected to do a little work.