kysely 0.28.13 → 0.28.14

package/dist/cjs/dialect/mysql/mysql-query-compiler.d.ts

@@ -9,5 +9,13 @@ export declare class MysqlQueryCompiler extends DefaultQueryCompiler {
     protected getLeftIdentifierWrapper(): string;
     protected getRightIdentifierWrapper(): string;
     protected sanitizeIdentifier(identifier: string): string;
+    /**
+     * MySQL requires escaping backslashes in string literals when using the
+     * default NO_BACKSLASH_ESCAPES=OFF mode. Without this, a backslash
+     * followed by a quote (\') can break out of the string literal.
+     *
+     * @see https://dev.mysql.com/doc/refman/9.6/en/string-literals.html
+     */
+    protected sanitizeStringLiteral(value: string): string;
     protected visitCreateIndex(node: CreateIndexNode): void;
 }

package/dist/cjs/dialect/mysql/mysql-query-compiler.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MysqlQueryCompiler = void 0;
 const default_query_compiler_js_1 = require("../../query-compiler/default-query-compiler.js");
+const LITERAL_ESCAPE_REGEX = /\\|'/g;
 const ID_WRAP_REGEX = /`/g;
 class MysqlQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompiler {
     getCurrentParameterPlaceholder() {
@@ -20,14 +21,24 @@ class MysqlQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompile
         return '';
     }
     getLeftIdentifierWrapper() {
-        return '`';
+        return ID_WRAP_REGEX.source;
     }
     getRightIdentifierWrapper() {
-        return '`';
+        return ID_WRAP_REGEX.source;
     }
     sanitizeIdentifier(identifier) {
         return identifier.replace(ID_WRAP_REGEX, '``');
     }
+    /**
+     * MySQL requires escaping backslashes in string literals when using the
+     * default NO_BACKSLASH_ESCAPES=OFF mode. Without this, a backslash
+     * followed by a quote (\') can break out of the string literal.
+     *
+     * @see https://dev.mysql.com/doc/refman/9.6/en/string-literals.html
+     */
+    sanitizeStringLiteral(value) {
+        return value.replace(LITERAL_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : "''");
+    }
     visitCreateIndex(node) {
         this.append('create ');
         if (node.unique) {

package/dist/cjs/query-builder/case-builder.d.ts

@@ -28,6 +28,14 @@ export declare class CaseThenBuilder<DB, TB extends keyof DB, W, O> {
      *
      * A `then` call can be followed by {@link Whenable.when}, {@link CaseWhenBuilder.else},
      * {@link CaseWhenBuilder.end} or {@link CaseWhenBuilder.endCase} call.
+     *
+     * **Note:** Numbers, booleans, and `null` values are inlined directly into the
+     * SQL query string (e.g. `then 1`, `then true`, `then null`) instead of being
+     * added as parameterized values (e.g. `then $1`). This allows the database
+     * engine to correctly infer the data type of the `case` expression result.
+     * Without this behavior, all results would be returned as strings.
+     *
+     * String values are always parameterized as usual.
      */
     then<E extends Expression<unknown>>(expression: E): CaseWhenBuilder<DB, TB, W, O | ExtractTypeFromValueExpression<E>>;
     then<V>(value: V): CaseWhenBuilder<DB, TB, W, O | V>;
@@ -47,6 +55,14 @@ export declare class CaseWhenBuilder<DB, TB extends keyof DB, W, O> implements W
      * Adds an `else` clause to the `case` statement.
      *
      * An `else` call must be followed by an {@link Endable.end} or {@link Endable.endCase} call.
+     *
+     * **Note:** Numbers, booleans, and `null` values are inlined directly into the
+     * SQL query string (e.g. `else 0`, `else false`, `else null`) instead of being
+     * added as parameterized values (e.g. `else $1`). This allows the database
+     * engine to correctly infer the data type of the `case` expression result.
+     * Without this behavior, all results would be returned as strings.
+     *
+     * String values are always parameterized as usual.
      */
     else<E extends Expression<unknown>>(expression: E): CaseEndBuilder<DB, TB, O | ExtractTypeFromValueExpression<E>>;
     else<V>(value: V): CaseEndBuilder<DB, TB, O | V>;

package/dist/esm/dialect/mysql/mysql-query-compiler.d.ts

@@ -9,5 +9,13 @@ export declare class MysqlQueryCompiler extends DefaultQueryCompiler {
     protected getLeftIdentifierWrapper(): string;
     protected getRightIdentifierWrapper(): string;
     protected sanitizeIdentifier(identifier: string): string;
+    /**
+     * MySQL requires escaping backslashes in string literals when using the
+     * default NO_BACKSLASH_ESCAPES=OFF mode. Without this, a backslash
+     * followed by a quote (\') can break out of the string literal.
+     *
+     * @see https://dev.mysql.com/doc/refman/9.6/en/string-literals.html
+     */
+    protected sanitizeStringLiteral(value: string): string;
     protected visitCreateIndex(node: CreateIndexNode): void;
 }

package/dist/esm/dialect/mysql/mysql-query-compiler.js

@@ -1,5 +1,6 @@
 /// <reference types="./mysql-query-compiler.d.ts" />
 import { DefaultQueryCompiler } from '../../query-compiler/default-query-compiler.js';
+const LITERAL_ESCAPE_REGEX = /\\|'/g;
 const ID_WRAP_REGEX = /`/g;
 export class MysqlQueryCompiler extends DefaultQueryCompiler {
     getCurrentParameterPlaceholder() {
@@ -18,14 +19,24 @@ export class MysqlQueryCompiler extends DefaultQueryCompiler {
         return '';
     }
     getLeftIdentifierWrapper() {
-        return '`';
+        return ID_WRAP_REGEX.source;
     }
     getRightIdentifierWrapper() {
-        return '`';
+        return ID_WRAP_REGEX.source;
     }
     sanitizeIdentifier(identifier) {
         return identifier.replace(ID_WRAP_REGEX, '``');
     }
+    /**
+     * MySQL requires escaping backslashes in string literals when using the
+     * default NO_BACKSLASH_ESCAPES=OFF mode. Without this, a backslash
+     * followed by a quote (\') can break out of the string literal.
+     *
+     * @see https://dev.mysql.com/doc/refman/9.6/en/string-literals.html
+     */
+    sanitizeStringLiteral(value) {
+        return value.replace(LITERAL_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : "''");
+    }
     visitCreateIndex(node) {
         this.append('create ');
         if (node.unique) {

package/dist/esm/query-builder/case-builder.d.ts

@@ -28,6 +28,14 @@ export declare class CaseThenBuilder<DB, TB extends keyof DB, W, O> {
      *
      * A `then` call can be followed by {@link Whenable.when}, {@link CaseWhenBuilder.else},
      * {@link CaseWhenBuilder.end} or {@link CaseWhenBuilder.endCase} call.
+     *
+     * **Note:** Numbers, booleans, and `null` values are inlined directly into the
+     * SQL query string (e.g. `then 1`, `then true`, `then null`) instead of being
+     * added as parameterized values (e.g. `then $1`). This allows the database
+     * engine to correctly infer the data type of the `case` expression result.
+     * Without this behavior, all results would be returned as strings.
+     *
+     * String values are always parameterized as usual.
      */
     then<E extends Expression<unknown>>(expression: E): CaseWhenBuilder<DB, TB, W, O | ExtractTypeFromValueExpression<E>>;
     then<V>(value: V): CaseWhenBuilder<DB, TB, W, O | V>;
@@ -47,6 +55,14 @@ export declare class CaseWhenBuilder<DB, TB extends keyof DB, W, O> implements W
      * Adds an `else` clause to the `case` statement.
      *
      * An `else` call must be followed by an {@link Endable.end} or {@link Endable.endCase} call.
+     *
+     * **Note:** Numbers, booleans, and `null` values are inlined directly into the
+     * SQL query string (e.g. `else 0`, `else false`, `else null`) instead of being
+     * added as parameterized values (e.g. `else $1`). This allows the database
+     * engine to correctly infer the data type of the `case` expression result.
+     * Without this behavior, all results would be returned as strings.
+     *
+     * String values are always parameterized as usual.
      */
     else<E extends Expression<unknown>>(expression: E): CaseEndBuilder<DB, TB, O | ExtractTypeFromValueExpression<E>>;
     else<V>(value: V): CaseEndBuilder<DB, TB, O | V>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kysely",
-  "version": "0.28.13",
+  "version": "0.28.14",
   "description": "Type safe SQL query builder",
   "repository": {
     "type": "git",