Raw sql`` quoting issue
Hi, I doing a work around until Drizzle supports generated columns. I have a manual script that adds the generated column + its index.
I'm dynamically building the
sql
query since there's no typings yet.
The syntax above returns no data or sometimes all the data b/c it generates: 'col-name' < '10'
, which doesn't match b/c of the quote around the column name.
If I hardcoded the query to:
Then it returns the correct results.
Am I using sql
incorrectly?
Thanks!
NOTE: I'm doing ${'10'}
to test the ${} syntax which seems to be working fine. It's only an issue w/ the column.17 Replies
I got around this by using
What you're seeing here is expected.
SQL
does not "understand" left side vs right side of expressions. Whenever you interpolate, it always escapes the value you put in as if it's a value
Typically you want to refer to the column name via the schema you created
Eg, if you have a users
table with a age
column,
age
in this case won't be a raw string, it'll be a data type the sanitizer knows it can inject "raw"asuming
someColumn
is a string, you can do either sql.raw(`'${someColumn}'`)
or name(someColumn)
(2nd one is preferred)Thanks Luxaritas, I'm hacking about w/ generated columns so there's no typings yet.
Cool thanks Dan, I'll give that a shot.
So the resulting expression might look like this:
When I log the
sql
, it looks like there's empty chunks. It throws a syntax error near "<"can you enable query logging and post the resulting query that's being run?
that's really weird
the query looks like valid sql
the queryChunks is odd
it looks like it's incorrectly parsing the chunks
for some reason, it puts
<
to params listoh, that's on purpose
my comparator is from a variable
but you posted this query:
sorry that's right. I'm mixing examples w/ my project
if you need the comparator to be a variable, wrap it in
sql.raw()
so that sql knows it's not a parameter but a SQL pieceperfect, that fixed it. Thanks a lot!
I'm craving proper
sql
documentation 😖
it's really flexible, and poorly documented right now