drizzle-team / drizzle-team/drizzle-orm

[FEATURE]: do not allow raw SQL execution in `db.execute()`, instead have a dedicated method for it.

Open
#3,598 2 comments 2 reactions 0 assignees View on GitHub
enhancement qb/crud
Dominant language
TypeScript
Stars
35.8k
Forks
1.6k
Avg merge
2d 7h
Merged PRs (30d)
4

Description

### Feature hasn't been suggested before.

- [X] I have verified this feature I'm about to request hasn't been suggested before.

### Describe the enhancement you want to request

I propose `db.execute()` should not allow executing a string.
Instead, a separate method should be added for that. For example: `db.executeSQLDangerously(sql: string)`.

**Motivation**

One can forget to use `sql` or accidentally remove it.

For example, these 2 snippets look eerily similar and the difference might be overlooked during code review:

```sql
await db.execute(sql`select * from users where id = ${id}`);
```
vs
```sql
await db.execute(`select * from users where id = ${id}`);
```

P.S. I'd be happy to submit a PR if this proposal is approved..

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.