parse-server VS slonik

Backend as a Service (BaaS) goes back to early 2010’s with companies like Parse and Firebase. These products integrated everything a backend provides to a webapp in a single, integrated package that makes it easier to get started and enables you to offload some of the devops maintenance work to someone else.

Prototype Pollution Fix

Parse Server is a great way to quickly spin up a backend for your project. Parse is a Node based utility that sits on top of ExpressJS.

Parse

You can try https://parseplatform.org/, it is self-hosted if you need. And also there are a number of cloud services with compatible API, like https://www.back4app.com/ It has dart-friendly generated API client, much simpler than firebase and is built on top of postgresql and mongodb.

Parse - https://parseplatform.org/

Not to crash the party or anything. Supabase is great and all but in terms of feature completeness and getting actual products built, it doesn't come close to Parse[0].

Same with Appwrite. Both of these are very popular but they either lack essential features or have them behind a subscription wall. For example, the OSS version of Supabase (last I checked) doesn't include the edge functions which are really important for easily computing stuff on the server side. Parse on the other hand is 100% open source and has a huge feature set. It's older than all of these lo-code tools and actually helps solve the issues one comes across when using such tools.

Another thing is extending these tools which is a pain. For example, Parse supports multiple databases by default (postgres & MongoDB) and the ability to write a custom adapter if you need something else. Similarly, if you at any point need to go 100% custom it also makes that possible so you are never locked in. These tools however don't have that level of low-level control and are general all or nothing kind of tools best for small-to-medium sized problems which don't have a lot of room to grow.

But both of these (Appwrite & Supabase) are super markety. Appwrite is all over the place with their ads, Supabase got a huge trend when it launched etc. Parse on the other hand is not too good at marketing their product being fully community run which is one reason not many know of it. Another is their not-so-fancy docs.

I have no stake in any of these products: just my conclusion after having tried all of these.

[0] https://parseplatform.org/

And sometimes invest instead in learning a technology rather than hide it: for example slonik encourages you to write normal SQL queries by making SQL templating easier and safer. In turn, your IDE would be able to understand those queries and give you support based on the database schemas you actually have.

I'd push you to consider using postgres, slonik or similar for database queries. With these libraries, you just write SQL, but they perform input sanitization for you. So you can safely write:

You can already use postgres with Slonik.

https://github.com/gajus/slonik#user-content-slonik-how-are-...

It is not going to be the default because it is way slower.

https://github.com/gajus/slonik/actions/runs/6616647651

Test node_version:18 test_only:postgres-integration is taking 3 minutes.

Test node_version:18 test_only:pg-integration is taking 38 seconds.

For those uninitiated, Slonik is a battle-tested SQL query building and execution library for Node.js. Its primary goal is to allow you to write and compose SQL queries in a safe and convenient way. Now, let's see how it pairs with Express.js.

I am the maintainer of Slonik and I am trying to understand what portion of this sub-users are using Slonik vs other libraries, and if they are using anything else – what are their reasons for it.

It's nice that they implemented string templates essentially exactly the same way Javascript template literals and tag functions work. They even give an example of using it to create a prepared statement (e.g. DB."SELECT * FROM foo WHERE bar = \{inputParam}") which is exactly what many NodeJS libraries due, e.g. Slonik https://github.com/gajus/slonik, like sql`SELECT * FROM foo WHERE bar = ${inputParam}`;

I've found libraries like Zod useful when interacting with external data sources like a database. Slonik[1] uses Zod to define the types expected from a SQL query and then performs runtime validation on the data to ensure that the query is yielding the expected type.

I don't think it's necessary to use Zod/runtime validation everywhere, but it's a nice tool to have on hand.

[1]https://github.com/gajus/slonik

Demonstrate how easily and accidentally one can make an SQL injection with these:

https://github.com/porsager/postgres

https://github.com/gajus/slonik

Have you tried Slonik (https://github.com/gajus/slonik)? It won't generate types from queries automatically, but it encourages writing SQL vs. a query builder and allows type annotations of queries with Zod. Query results are validated at runtime to ensure the queries are typed correctly.