sql() function

SQL as a tagged template, with everything interpolated bound.

Signature:

export declare function sql(strings: TemplateStringsArray, ...values: unknown[]): SqlFragment;

Parameters

Returns:

SqlFragment

The statement and its values.

Remarks

This is what Prisma.sql was, and it exists for the same reason: a column cannot be a bind parameter, so a query built from a caller's choices has to be assembled — and assembling it by concatenation is how an injection gets written. Everything interpolated is bound unless it is itself a fragment, in which case it is spliced and its own placeholders renumbered.

Use raw() for the parts that genuinely cannot be bound, and read its warning first.

Example

const rows = await pool.query(
    ...toQuery(sql`SELECT * FROM "User" WHERE id = ${id}`),
);

Read this page as plain markdown — no HTML, no navigation. For pasting into an LLM, or for an agent to fetch.