You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the above example, we used a variable in our raw SQL. Thanks to the `sql` tag, Sequelize will automatically escape that variable to remove any risk of SQL injection.
39
39
40
-
Sequelize supports two different ways to pass variables in raw SQL: **Replacements** and **Bind Parameters**.
40
+
Sequelize supports two different ways to pass variables in raw SQL: **Replacements** and **Bind Parameters**.
41
41
Replacements and bind parameters are available in all querying methods, and can be used together in the same query.
42
42
43
43
### Replacements
@@ -60,7 +60,7 @@ The `replacements` option must contain all bound values, or Sequelize will throw
60
60
```js
61
61
import { QueryTypes } from'@sequelize/core';
62
62
63
-
// This query use positional replacements
63
+
// This query uses positional replacements
64
64
awaitsequelize.query('SELECT * FROM projects WHERE status = ?', {
65
65
replacements: ['active'],
66
66
});
@@ -136,7 +136,7 @@ await Project.findAll({
136
136
});
137
137
```
138
138
139
-
Sequelize does not currently support a way to [specify the DataType of a bind parameter](https://github.com/sequelize/sequelize/issues/14410).
139
+
Sequelize does not currently support a way to [specify the DataType of a bind parameter](https://github.com/sequelize/sequelize/issues/14410).
140
140
Until such a feature is implemented, you can cast your bind parameters if you need to change their DataType:
141
141
142
142
```js
@@ -259,6 +259,34 @@ await sequelize.query(sql`SELECT * FROM ${sql.identifier('projects')}`);
-- The identifier quotes are dialect-specific, this is an example for PostgreSQL
287
+
SELECT*FROM"users"
288
+
```
289
+
262
290
### `sql.list`
263
291
264
292
When using an array as a variable in a query, Sequelize will by default treat it as an SQL array:
@@ -293,6 +321,46 @@ Read more about this in [#15142](https://github.com/sequelize/sequelize/issues/1
293
321
294
322
:::
295
323
324
+
### `sql.join`
325
+
326
+
The `sql.join` function can be used to join multiple SQL fragments together.
327
+
It is designed to be the equivalent of [`Array.prototype.join`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/join) for SQL fragments.
awaitsequelize.query(sql`SELECT ${sql.join(columns, ', ')} FROM projects`);
333
+
```
334
+
335
+
```sql
336
+
-- The identifier quotes are dialect-specific, this is an example for PostgreSQL
337
+
SELECT"name", "funding"FROM projects
338
+
```
339
+
340
+
Like with the `sql` tag, all non-sql values in the array passed to `sql.join` will be escaped:
341
+
342
+
```ts
343
+
const values = ['active', 'pending'];
344
+
345
+
awaitsequelize.query(sql`SELECT * FROM projects WHERE status IN (${sql.join(values, ', ')})`);
346
+
```
347
+
348
+
```sql
349
+
SELECT*FROM projects WHERE status IN ('active', 'pending')
350
+
```
351
+
352
+
The separator can also be any SQL fragment:
353
+
354
+
```ts
355
+
const values = ['active', 'pending'];
356
+
357
+
awaitsequelize.query(sql`SELECT * FROM projects WHERE status IN ${sql.join(values, sql`, `)}`);
358
+
```
359
+
360
+
```sql
361
+
SELECT*FROM projects WHERE status IN ('active', 'pending')
362
+
```
363
+
296
364
### `sql.where`
297
365
298
366
The `sql.where` function can be used to generate an SQL condition from a JavaScript object, using the same syntax as the [`where` option of the `findAll` method](./select-in-depth.md#applying-where-clauses).
0 commit comments