query.E() function

Renders a value as a SQL constant: a number as itself, a string quoted and escaped, anything else as NULL.

Signature:

export function E(input: any): string | number;

Parameters

Returns:

string | number

The number itself, a quoted and escaped string, or NULL.

Remarks

The companion to query.L() and the only safe way to get a runtime value into a literal. Single quotes inside a string are doubled, which is what Postgres requires — and what this did not do: a value of O'Brien came out as a broken string constant, and a value chosen deliberately came out as SQL. The same path escapes a dynamic view's parameters, so a view selected with caller-supplied viewParams was open the same way.

Only numbers and strings render as values. Booleans, dates, objects, null and undefined all become NULL — so format a date as a string before passing it, and do not reach for this to render a boolean.