Closed turbo closed 1 year ago
In order to use SQL syntax with the table name argument you can use db.raw("foo.bar")
to inject it directly into the query:
db.update db.raw("foo.bar"), { ... }, { ... }
Keep in mind that no escaping will be happening, so you should either only use string literals you've typed, or if you are using input you can't fully trust:
db.raw(db.escape_identifier(first_part) .. "." .. db.escape_identifier(second_part))
Interesting. I guess the other DB methods also handle db.raw values differently? If so, it might be worth adding a note to the docs.
I wouldn't say differently, but consistently. Any default escaping can be avoided with raw. This definitely should be mentioned in the docs though!
Just noting now that db.clause
supports a table_name
option to allow you to automatically prefix a name to a field name. https://leafo.net/lapis/reference/database.html#database-primitives/db.clause
Here's a quirky bug that I don't know how to actually resolve. The workaround is using raw parameterized queries.
In Postgres, to address a table in another schema, it's prefixed with
schema.table
. However, quoting rules say thatschema.table
referencestable
inschema
, while"schema.table"
referencespublic."schema.table"
.So when you're trying to use e.g.
db.update
, the explicit quoting added by that function prevents it from working with schemas. For example:will fail with
Even though
bar
exists infoo
and executing the SQL myself without the quotes works just fine.