Skip to content

Commit 045cccf

Browse files
committed
Fix typos, add pg manual escape example
1 parent dfc2eea commit 045cccf

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ db.query(SQL`SELECT * FROM ${SQL.raw(table)} WHERE author = ${author} ORDER BY $
4444

4545
// you MUST escape user input manually
4646
mysql.query(SQL`SELECT * FROM ${SQL.raw(mysql.escapeId(someUserInput))} WHERE name = ${book} ORDER BY ${column} ${SQL.raw(order)}`)
47+
pg.query(SQL`SELECT * FROM ${SQL.raw(pg.escapeIdentifier(someUserInput))} WHERE name = ${book} ORDER BY ${column} ${SQL.raw(order)}`)
4748

4849
// you might need to add quotes
4950
pg.query(SQL`SELECT * FROM "${SQL.raw(table)}"`)
@@ -57,8 +58,8 @@ for (let table of largeArray) {
5758
}
5859
```
5960

60-
## Prepared Statements in Postgre
61-
Postgre requires prepared statements to be named, otherwise the parameters will be escaped and replaced on the client side.
61+
## Prepared Statements in Postgres
62+
Postgres requires prepared statements to be named, otherwise the parameters will be escaped and replaced on the client side.
6263
You can still use SQL template strings though, you just need to assign a name to the query before using it:
6364
```js
6465
// old way

0 commit comments

Comments
 (0)