method

TransactionSQL.unsafe

unsafe<T = any>(
string: string,
values?: any[] | Record<string, any>
): Query<T>;

Executes any query string as-is. This can lead to SQL injection if the string contains untrusted input.

sql.unsafe can be nested inside a safe sql expression, for example when only part of the query is unsafe.

With the SQLite adapter, values may also be an object of named parameters (:name, $name, or @name placeholders). Object keys keep the prefix unless the connection sets strict: true.

const result = await sql.unsafe(`select ${danger} from users where id = ${dragons}`)
const row = await sql.unsafe("select * from users where id = :id", { ":id": 1 })

Referenced types

interface Query<T>

A pending SQL query. Extends Promise, so it can be awaited, and adds methods to control how it runs.

  • readonly [Symbol.toStringTag]: string
  • active: boolean

    True while the query is executing

  • cancelled: boolean

    True if the query has been cancelled

  • cancel(): Query<T>;

    Cancels the executing query

  • catch<TResult = never>(
    onrejected?: null | (reason: any) => TResult | PromiseLike<TResult>
    ): Promise<T | TResult>;

    Attaches a callback for only the rejection of the Promise.

    @param onrejected

    The callback to execute when the Promise is rejected.

    @returns

    A Promise for the completion of the callback.

  • execute(): Query<T>;

    Starts executing the query. Queries are lazy: they only run when awaited or executed with this method.

  • onfinally?: null | () => void
    ): Promise<T>;

    Attaches a callback that is invoked when the Promise is settled (fulfilled or rejected). The resolved value cannot be modified from the callback.

    @param onfinally

    The callback to execute when the Promise is settled (fulfilled or rejected).

    @returns

    A Promise for the completion of the callback.

  • raw(): Query<T>;

    Returns rows as arrays of Buffer objects instead of objects

  • simple(): Query<T>;

    Executes the query as a simple query. Parameters are not allowed, but the query can contain multiple commands separated by semicolons.

  • then<TResult1 = T, TResult2 = never>(
    onfulfilled?: null | (value: T) => TResult1 | PromiseLike<TResult1>,
    onrejected?: null | (reason: any) => TResult2 | PromiseLike<TResult2>
    ): Promise<TResult1 | TResult2>;

    Attaches callbacks for the resolution and/or rejection of the Promise.

    @param onfulfilled

    The callback to execute when the Promise is resolved.

    @param onrejected

    The callback to execute when the Promise is rejected.

    @returns

    A Promise for the completion of which ever callback is executed.

  • values(): Query<T>;

    Returns each row as an array of values, in the same order as the columns in the query