drizzle-team / drizzle-team/drizzle-orm
[FEATURE]: do not allow raw SQL execution in `db.execute()`, instead have a dedicated method for it.
- Dominant language
- TypeScript
- Stars
- 35.8k
- Forks
- 1.6k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 4
Description
### Feature hasn't been suggested before.
- [X] I have verified this feature I'm about to request hasn't been suggested before.
### Describe the enhancement you want to request
I propose `db.execute()` should not allow executing a string.
Instead, a separate method should be added for that. For example: `db.executeSQLDangerously(sql: string)`.
**Motivation**
One can forget to use `sql` or accidentally remove it.
For example, these 2 snippets look eerily similar and the difference might be overlooked during code review:
```sql
await db.execute(sql`select * from users where id = ${id}`);
```
vs
```sql
await db.execute(`select * from users where id = ${id}`);
```
P.S. I'd be happy to submit a PR if this proposal is approved..
Contributor guide
Assessment
This issue has not been assessed yet.