slonik VS pg-promise

And sometimes invest instead in learning a technology rather than hide it: for example slonik encourages you to write normal SQL queries by making SQL templating easier and safer. In turn, your IDE would be able to understand those queries and give you support based on the database schemas you actually have.

I'd push you to consider using postgres, slonik or similar for database queries. With these libraries, you just write SQL, but they perform input sanitization for you. So you can safely write:

You can already use postgres with Slonik.

https://github.com/gajus/slonik#user-content-slonik-how-are-...

It is not going to be the default because it is way slower.

https://github.com/gajus/slonik/actions/runs/6616647651

Test node_version:18 test_only:postgres-integration is taking 3 minutes.

Test node_version:18 test_only:pg-integration is taking 38 seconds.

For those uninitiated, Slonik is a battle-tested SQL query building and execution library for Node.js. Its primary goal is to allow you to write and compose SQL queries in a safe and convenient way. Now, let's see how it pairs with Express.js.

I am the maintainer of Slonik and I am trying to understand what portion of this sub-users are using Slonik vs other libraries, and if they are using anything else – what are their reasons for it.

It's nice that they implemented string templates essentially exactly the same way Javascript template literals and tag functions work. They even give an example of using it to create a prepared statement (e.g. DB."SELECT * FROM foo WHERE bar = \{inputParam}") which is exactly what many NodeJS libraries due, e.g. Slonik https://github.com/gajus/slonik, like sql`SELECT * FROM foo WHERE bar = ${inputParam}`;

I've found libraries like Zod useful when interacting with external data sources like a database. Slonik[1] uses Zod to define the types expected from a SQL query and then performs runtime validation on the data to ensure that the query is yielding the expected type.

I don't think it's necessary to use Zod/runtime validation everywhere, but it's a nice tool to have on hand.

[1]https://github.com/gajus/slonik

Demonstrate how easily and accidentally one can make an SQL injection with these:

https://github.com/porsager/postgres

https://github.com/gajus/slonik

Have you tried Slonik (https://github.com/gajus/slonik)? It won't generate types from queries automatically, but it encourages writing SQL vs. a query builder and allows type annotations of queries with Zod. Query results are validated at runtime to ensure the queries are typed correctly.

Personally with more time I would also use JavaScript so I can improve it. Last time I wrote something with Express and a database connection is a long time ago and not for work, only for my personal testing. But for JavaScript database connection to PostgreSQL I recommend pg-promise. That works like a charm.

I've always loved this project / product:

https://github.com/outline/outline

I think the guy who built it posts here. There's also pg-promise, a "Postgres interface for Node.js":

https://github.com/vitaly-t/pg-promise

Raw pgPromise with string templating.

i do have a couple of them like websocket server using ws, bullmq for sending emails and postgres listen/notify to push data to websocket clients. Would you happen to have any ideas on how to go about these? I did some research

Yes. You can also take at the pg-promise library. https://github.com/vitaly-t/pg-promise

Is there any difference to the named parameters already supported? https://github.com/vitaly-t/pg-promise#named-parameters

During my years as a dev i have really started to dislike ORMs. They always fail in the end. SQL is universal, and transfers between languages and tech fields. This is why im pro-sql, and always try to avoid unnecessary abstractions.

I have actually went back to writing pure SQL in files, and using those as params for whatever db engine i use, this makes it even possible to reuse the code in other projects (even its unlikely that you can use the exact same query, but just as a "it would work" in theory).

For node based projects i have used and would probably still choose pg-promise (https://github.com/vitaly-t/pg-promise).

Since I'm decent at writing SQL queries and I don't want to learn additional syntax to work with ORMs/query builders, I stay as close as possible to the database driver. pg-promise is an excellent library built on top of the Node.js driver for PostgreSQL. It's built with promises in mind, it's well-tested and typed.

dont believe me? look at how many open issues they have https://github.com/vitaly-t/pg-promise/issues

I just used pg-promise - it handles the connections for you, up to you to write the SQL.