Add support for parameterized queries

[abrkn]

No amount of escaping will safe you from SQL injection attacks. Queries must be parameterized.

http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html

[mtsr]

I just added pull request #34 for this functionality (initially compatible with node-postgres).

[hiddentao]

Squel does support parameterized queries, using the usingValuePlaceholders option, see in http://hiddentao.github.io/squel/#update

I think I need to add a top-level section to the docs for parameterized queries to make this clearer to people.

[mtsr]

Well sure, you can do this:

var query = squel.update()
  .table("students")
  .set("name", "$1")
  .set("gender", "$2")
  .toString();

// node-postgres client
client.query({ text: query, values: ['Thomas', 'M'] });

But using my pull request you can do

var query = squel.update()
  .table("students")
  .set("name", "Thomas")
  .set("gender", "M")
  .toParam();

// node-postgres client
client.query(query);

which is much easier to read and maintain.

[abrkn]

👍

[hiddentao]

Version 2.0.0 now has the toParam() method included from #34