Use sqlstring to escape sql parameters

__tests__/index.test.ts

@@ -98,6 +98,55 @@ describe('execute', () => {
 
  expect(got2).toEqual(want)
  })
+
+ test('it properly escapes query parameters', async () => {
+ const mockResponse = {
+ session: null,
+ result: {
+ fields: [
+ {
+ name: ':vtg1',
+ type: 'INT64'
+ }
+ ],
+ rows: [
+ {
+ lengths: ['1'],
+ values: 'MQ=='
+ }
+ ]
+ }
+ }
+
+ const want: ExecutedQuery = {
+ headers: [':vtg1'],
+ rows: [
+ {
+ ':vtg1': 1
+ }
+ ],
+ size: 1,
+ statement: "SELECT 1 from dual where foo = 'bar';",
+ time: 1
+ }
+
+ mockPool
+ .intercept({
+ path: EXECUTE_PATH,
+ method: 'POST'
+ })
+ .reply(200, (opts) => {
+ const bodyObj = JSON.parse(opts.body.toString())
+ expect(bodyObj.query).toEqual(want.statement)
+ return mockResponse
+ })
+
+ const connection = connect(config)
+ const got = await connection.execute('SELECT ? from dual where foo = ?;', [1, 'bar'])
+ got.time = 1
+
+ expect(got).toEqual(want)
+ })
 })
 
 describe('refresh', () => {

package.json

@@ -89,5 +89,9 @@
  "browser": true,
  "node": true
  }
+ },
+ "dependencies": {
+ "@types/sqlstring": "^2.3.0",
+ "sqlstring": "^2.3.3"
  }
 }

src/index.ts

@@ -1,3 +1,4 @@
+import * as SqlString from 'sqlstring'
 import { utf8Encode } from './text.js'
 
 type ReqInit = Pick<RequestInit, 'method' | 'headers'> & {
@@ -65,8 +66,8 @@ export class Client {
  this.config = config
  }
 
- async execute(query: string): Promise<ExecutedQuery> {
- return this.connection().execute(query)
+ async execute(query: string, args?: object | any[]): Promise<ExecutedQuery> {
+ return this.connection().execute(query, args)
  }
 
  connection(): Connection {
@@ -125,9 +126,10 @@ export class Connection {
  }
  }
 
- async execute(query: string): Promise<ExecutedQuery> {
+ async execute(query: string, args?: object | any[]): Promise<ExecutedQuery> {
  const startTime = Date.now()
  const url = new URL('/psdb.v1alpha1.Database/Execute', `https://${this.config.host}`)
+ query = SqlString.format(query, args)
  const saved = await this.postJSON<QueryExecuteResponse>(url, {
  query: query,
  session: this.session