Knex VS pgtyped

Knex.js

AdonisJS core team has created/maintains Lucid. It is a SQL query builder, and an Active Record ORM built on top of Knex.

Now, why not use an ORM? I've seen performance issues too many times with ORMs. I prefer writing my own SQL to avoid surprises. After all, I know the database schema and writing code for a specific purpose very often leads to better performance than generic code. ORMs have to support all kinds of database schemas. I only have to support mine. Having successfully used Knex.js in NodeJS (a popular query builder) in the past, I know writing SQL queries myself is not hard and provides very good performance.

Given the dynamic nature of the schema, we employ Knex, a query builder, for database access.

https://www.npmjs.com/package/knex - 779 issues

# related: https://github.com/knex/knex/issues/2354

This article will be focused on a security issue that I found in Knex and how to mitigate it, but I'll also talk briefly about the social aspects of this problem.

SQL is an old, irregular language to work with, but it is better known than HCL and SQL already has it's own Pulumi/CDK in the form of every ORM with introspection (like Javascript's Prisma, Python's Django, Go's XO etc) and QueryBuilder (LINQ, Knex, etc) in whatever programming language you prefer. You probably already know it.

There is an implementation of SQL that operates on a table shaped type, entirely at type level. For your amusement: https://github.com/codemix/ts-sql

There are a bunch of more practical takes that codegen types from your database and generate types for your queries, eg: https://github.com/adelsz/pgtyped

To me the second approach seems much more pragmatic because you don’t need to run a SQL parser in a fairly potato interpreter on every build

ORMs suck, but raw SQL embedded in your code sucks too.

This might be good time to plug my TypeScript non-ORM: https://jawj.github.io/zapatos/.

I should say I also like what I've seen of https://kysely.dev/ and https://pgtyped.dev/.

Thank you for suggestions they helped me finding what I was looking for. I will either pick kysely or https://pgtyped.dev/, but first I will do some tests. Thanks!

Cool. How does this compare to SafeQL, PgTyped, and Postgres language server ?

I would instead rely on code generation like https://github.com/adelsz/pgtyped, because the embedded type-safe SQL will never fully cover all the features of vanilla SQL, for example Common Table Expression (CTE), window functions etc.

There's pgtyped, which I believe does almost the same as sqlc

https://github.com/adelsz/pgtyped

For Postgres there is https://github.com/adelsz/pgtyped, sounds pretty much like what you describe?

Avoiding the cost of learning EDSL that many Haskell DB libraries provide, I found out that only postgresql-typed and postgresql-simple allow to write only raw SQL queries easily. As I extensively use pgtyped for production Node.js application, I am thinking about using postgresql-typed. While I could find many resources for postgresql-simple, the same cannot be said try for postgresql-typed.

I would highly recommend trying out pgTyped if you want typesafe queries with postgres. It's fantastic!