Node.js / Javascript equivalent for mysql_real_escape_string()

Question

I need to make a JavaScript string which is passed into Node.js friendly for MSSQL.

This question: Making a javascript string sql friendly has a great answer that explains how to escape strings for MySQL:

Credit to Paul D'Aoust

function mysql_real_escape_string (str) {
    return str.replace(/[\0\x08\x09\x1a\n\r"'\\\%]/g, function (char) {
        switch (char) {
            case "\0":
                return "\\0";
            case "\x08":
                return "\\b";
            case "\x09":
                return "\\t";
            case "\x1a":
                return "\\z";
            case "\n":
                return "\\n";
            case "\r":
                return "\\r";
            case "\"":
            case "'":
            case "\\":
            case "%":
                return "\\"+char; // prepends a backslash to backslash, percent,
                                  // and double/single quotes
        }
    });
}

I need to achieve the exact same thing for MSSQL.

I have spent the last hour (probably longer) searching for an answer however, there does not seem to be a lot of documentation on the internet that explains how to do this. The official mssql package documentation only mentions prepared statements however, I want to find a way to do this without prepared statements.

Why do you not want to use parameterized queries? They're the correct approach (even for MySQL). — Ry-
– Ry- ♦, Commented Sep 13, 2017 at 2:04
Question upvoted, but what is stopping you from writing a similar user defined function in SQL Server? — Tim Biegeleisen
– Tim Biegeleisen, Commented Sep 13, 2017 at 2:04
"however, I want to find a way to do this without prepared statements." - No, you really don't. Unless you are prepared to make are really compelling case that explains all the details of why your situation is too special for prepared statements. Everyone is using prepared statements/parameters to communicate with databases. Even really, really complex solutions do it. Why do you think you can't? — Tomalak
– Tomalak, Commented Sep 13, 2017 at 3:38

Ssword · Accepted Answer · 2025-11-04 13:57:21Z

use parameterized queries instead. because it is handed to the sql server itself to take care of the responsibilities of inserting said value to the database. so it understands better that the data is one string that should not be interpreted by any means as sql directives / syntax (e.g: when the user entered "'", it could terminate the string when using unparameterized queries, instead, use parameterized queries, normally written like (or atleast in mysql, idk about mssql):

SELECT * FROM TABLE 'users' WHERE id = ?

in this case, it is retrieving all users with the id specified via the library used for connecting and querying to the database, e.g: mysql package for node js (installed via npm) for connecting to mysql databases.

so if we provide the id (first parameter) to be 12, it would select all users with the id 12. if the user provided 12', it would interpret it as "12'" so if the id was a string, the quote in the input will not close the string. instead, interpreted as raw string data, not mysql code, making it more secure against sql-injection.

Power Engineering · Accepted Answer · 2025-11-04 12:32:35Z

-1

Should be str.replaceAll instead of str.replace otherwise just the first occurrence will be processed.

answered Nov 4 at 12:32

Power Engineering

7202 gold badges14 silver badges27 bronze badges

Collectives™ on Stack Overflow

Node.js / Javascript equivalent for mysql_real_escape_string()

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related