Safe From SQL Injection
Using tagged template literals for queries, e.g.
db.query(sql`SELECT * FROM users WHERE id=${userID}`);
makes it virtually impossible for SQL Injection attacks to slip in
un-noticed. All the @databases libraries enforce the use of the sql
tagged template literals, so you can't accidentally miss them.
The query is then passed to Postgres as a separate string and values:
{text: 'SELECT * FROM users WHERE id=?', values: [userID]}
Promises
Promises
All the @databases APIs are designed with promises in mind from the get go.
Type Safe
Type Safe
Written in TypeScript, so every module has type safety and type definitions built in.
Modular
Modular
Each database driver is published to npm as a separate module.
