3

I need to make a JavaScript string which is passed into Node.js friendly for MSSQL.

This question: Making a javascript string sql friendly has a great answer that explains how to escape strings for MySQL:

Credit to Paul D'Aoust

function mysql_real_escape_string (str) {
    return str.replace(/[\0\x08\x09\x1a\n\r"'\\\%]/g, function (char) {
        switch (char) {
            case "\0":
                return "\\0";
            case "\x08":
                return "\\b";
            case "\x09":
                return "\\t";
            case "\x1a":
                return "\\z";
            case "\n":
                return "\\n";
            case "\r":
                return "\\r";
            case "\"":
            case "'":
            case "\\":
            case "%":
                return "\\"+char; // prepends a backslash to backslash, percent,
                                  // and double/single quotes
        }
    });
}

I need to achieve the exact same thing for MSSQL.

I have spent the last hour (probably longer) searching for an answer however, there does not seem to be a lot of documentation on the internet that explains how to do this. The official mssql package documentation only mentions prepared statements however, I want to find a way to do this without prepared statements.

cleverpaul
  • 935
  • 4
  • 12
  • 28
  • 3
    Why do you not want to use parameterized queries? They're the correct approach (even for MySQL). – Ry- Sep 13 '17 at 02:04
  • Question upvoted, but what is stopping you from writing a similar user defined function in SQL Server? – Tim Biegeleisen Sep 13 '17 at 02:04
  • 1
    *"however, I want to find a way to do this without prepared statements."* - No, you really don't. Unless you are prepared to make are *really* compelling case that explains all the details of why your situation is too special for prepared statements. Everyone is using prepared statements/parameters to communicate with databases. Even really, really complex solutions do it. Why do you think you can't? – Tomalak Sep 13 '17 at 03:38

0 Answers0