Knex VS Express

Knex.js

AdonisJS core team has created/maintains Lucid. It is a SQL query builder, and an Active Record ORM built on top of Knex.

Now, why not use an ORM? I've seen performance issues too many times with ORMs. I prefer writing my own SQL to avoid surprises. After all, I know the database schema and writing code for a specific purpose very often leads to better performance than generic code. ORMs have to support all kinds of database schemas. I only have to support mine. Having successfully used Knex.js in NodeJS (a popular query builder) in the past, I know writing SQL queries myself is not hard and provides very good performance.

Given the dynamic nature of the schema, we employ Knex, a query builder, for database access.

https://www.npmjs.com/package/knex - 779 issues

This article will be focused on a security issue that I found in Knex and how to mitigate it, but I'll also talk briefly about the social aspects of this problem.

SQL is an old, irregular language to work with, but it is better known than HCL and SQL already has it's own Pulumi/CDK in the form of every ORM with introspection (like Javascript's Prisma, Python's Django, Go's XO etc) and QueryBuilder (LINQ, Knex, etc) in whatever programming language you prefer. You probably already know it.

How does HN receive SQL builders in general? I feel like most of us agree ORMs are typically a bad idea. I feel like that almost instantly leaves the need for "something" to take its place. In my experience, it's typically been a query builder like this.

I've also tried:

https://knexjs.org/

https://www.npmjs.com/package/sql-template-strings ("out of date" since like 2016? https://www.npmjs.com/package/sql-template-tag might be better)

Are query builders an anti pattern? People who are doing serious/logic heavy stuff with SQL, how do you avoid a query builder (if at all?)

Of course, this is a trivial example that you probably won’t find in production code, but there are many projects that use lazy-evaluated Promise-like objects. Probably the most common example is with database ORMs and query builders like Knex.js or Prisma.

Express.js Documentation

In the JavaScript ecosystem, there are guides for enabling SAML-based enterprise single sign-on in AdonisJS, Express.js, Next.js, Remix, and React with an Express.js backend.

Starting off strong with Express.js, the cool kid on the block for building web apps. It's lightweight, flexible, and doesn't throw a tantrum when you ask it to scale. With Express, you can handle HTTP requests like a pro, play around with middleware, set up routes without breaking a sweat, and render views that make your app look stunning. Big names like Netflix and Uber are already on board, and if it's good enough for them, it's definitely worth a peek.

express - one of the most popular middleware tools, lightweight and easy to learn. docs

Converting a large Express.js application from JavaScript to TypeScript can be a challenging task. For many applications, this represents a significant portion of their technical debt, as the process may span many days, if not months, and new changes are typically not allowed during the conversion.

Nitro is a nice https webserver that you can deploy everywhere. Comparing it to express, it doesn't need weird middlewares for json, it has a simple way to support caching, a file system router, tasks and scheduled tasks that avoid quite a few shell scripts, db:migrations etc, plugins, KV storages, SQL connectors, websockets...

As you might have seen from this PR and in our forums Meteor v3(it is still in beta, but you can follow the progress here) will be released with a new engine, expressjs.

Express JS

Express.js Documentation - Official documentation for Express.js, a minimal and flexible Node.js web application framework for backend development. Express.js Documentation

To better understand how SQL injection works, let's quickly create a vulnerable app using Node.js, Express, and a PostgreSQL database. The application takes user input from a form, constructs a SQL query, and executes it against the database to fetch some data.