escape-sql-string

library1.2.2jsnpmunverified

A minimal SQL string escaping library to prevent SQL injection attacks. Current stable version is 1.2.2, with infrequent releases and no breaking changes expected. It provides a single function to escape single quotes and optionally backslashes, supporting both standard SQL (backslash not supported) and engines that do support backslash escapes. Ships TypeScript types. Key differentiator: simplicity and zero dependencies.

security

npm install escape-sql-string

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · ESCAPE-SQL-STRING

escape-sql-string

securityjavascriptv1.2.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

escapeString

✓ import escapeString from 'escape-sql-string'

✗ const escapeString = require('escape-sql-string')

Package is ESM-only; default export is a function. CommonJS require will fail unless using dynamic import or a bundler that handles ESM.

(default) as any name

✓ import myEscape from 'escape-sql-string'

✗ import { escapeString } from 'escape-sql-string'

Named import is incorrect because package exports a default function, not a named export. The function is the default export.

(type import)

✓ import type escapeString from 'escape-sql-string'

✗ import { escapeString } from 'escape-sql-string'

When importing only the type, use 'import type' to avoid runtime inclusion. However, the exported type is not explicitly named; the function itself is callable.

Shows basic use of escapeString with default options and with backslash support enabled.

import escapeString from 'escape-sql-string'; const unsafe = "O'Brien"; const safe = escapeString(unsafe); // safe is "'O''Brien'" console.log(safe); // With backslash support const safe2 = escapeString(unsafe, { backslashSupported: true }); // safe2 is "'O\'Brien'" console.log(safe2);

Debug

Known issues

gotchaDefault escaping does not escape backslashes or double quotes, which may be unsafe for SQL engines that interpret backslashes.

fix

Set `{ backslashSupported: true }` if your SQL engine supports backslash escapes, or manually escape backslashes.

affects: <2.0.0

gotchaThe library does not validate input type; passing non-string values may cause runtime errors.

fix

Always pass a string to escapeString.

affects: >=1.0.0

deprecatedThe package has not been updated in over 2 years; consider using more actively maintained alternatives.

fix

Consider using `sqlstring` or `mysql2`'s escaping functions for broader support.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: escapeString is not a function

Using CommonJS require incorrectly.

fix

Use ES module import: `import escapeString from 'escape-sql-string'`.

SyntaxError: Unexpected token 'export'

Trying to use the package in a CommonJS environment without transpilation.

fix

Set `"type": "module"` in package.json or use a bundler that supports ESM.

ReferenceError: escapeString is not defined

Named import instead of default import.

fix

Use `import escapeString from 'escape-sql-string'` instead of `import { escapeString } from 'escape-sql-string'`.

Upgrade

Version history

1.2.2latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

28 hits · last 30 days

node

Bingbot

OpenAI (training)

Resources

githubgit://github.com/jackall3n/escape-sql-string ↗

packageescape-sql-string ↗

homepagehttps://github.com/jackall3n/escape-sql-string ↗