mssql 9.1.2 → 9.1.4

package/README.md

@@ -2,7 +2,7 @@
 
 Microsoft SQL Server client for Node.js
 
-[![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Appveyor CI][appveyor-image]][appveyor-url] [![Join the chat at https://gitter.im/patriksimek/node-mssql](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/patriksimek/node-mssql?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+[![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Join the chat at https://gitter.im/patriksimek/node-mssql](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/patriksimek/node-mssql?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
 Supported TDS drivers:
 - [Tedious][tedious-url] (pure JavaScript - Windows/macOS/Linux, default)
@@ -108,6 +108,13 @@ async () => {
 * [bulk](#bulk-table-options-callback)
 * [cancel](#cancel)
 
+### Identifier rules
+
+* [Parameter names](#parameter-names)
+* [Column names](#column-names)
+* [Type names and sizes](#type-names-and-sizes)
+* [Procedure names](#procedure-names)
+
 ### Transactions
 
 * [Transaction](#transaction)
@@ -746,6 +753,7 @@ request.execute('procedure_name', (err, result) => {
 
 __Errors__
 - EREQUEST (`RequestError`) - *Message from SQL Server*
+- EINJECT (`RequestError`) - Procedure name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 - ECANCEL (`RequestError`) - Cancelled.
 - ETIMEOUT (`RequestError`) - Request timeout.
 - ENOCONN (`RequestError`) - No connection is specified for that request.
@@ -798,7 +806,7 @@ sql.map.register(Number, sql.BigInt)
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -823,7 +831,7 @@ request.output('output_parameter', sql.VarChar(50), 'abc')
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -907,6 +915,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ```javascript
 const request = new sql.Request()
@@ -952,6 +961,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 You can enable multiple recordsets in queries with the `request.multiple = true` command.
 
@@ -998,6 +1008,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Column name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1228,7 +1239,7 @@ ps.input('input_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1250,7 +1261,7 @@ ps.output('output_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1823,6 +1834,100 @@ Results in:
 ]
 ```
 
+## Identifiers
+
+Values are sent to the server as parameters and may hold anything. A few things
+are not values, and cannot be: the name of a parameter, the name of a column in a
+bulk load, the type a parameter is declared as, and the name of a stored procedure.
+Those are *identifiers*, and
+no SQL database can bind them, so this library builds them into the statement it
+sends. It checks them, and rejects anything that could end the identifier and have
+the rest of the value read as SQL.
+
+That check is not a substitute for your own. If any of these comes from somewhere
+you do not control, map it to a value you expect first:
+
+```javascript
+const columns = { name: 'name', created: 'created_at' }        // what you allow
+const column = columns[req.query.sortBy]                       // what they asked for
+if (!column) throw new Error('unknown column')
+
+request.input(column, sql.NVarChar, value)
+```
+
+### Parameter names
+
+`request.input()`, `request.output()` and the same methods on a prepared statement
+take a name without the leading `@`. It may hold letters, digits, marks and
+connector punctuation from any script, along with `@`, `#`, `$` and the two
+zero-width joiners. A name that is not a string or a number is rejected, as is one
+holding an invisible format character, because one of them is a separator the
+server treats as ending the identifier.
+
+Anything else raises `EINJECT`. Note that a name this library accepts may still be
+one the server rejects; the check is deliberately wider than the server's own rules
+so that it only refuses what could change the shape of the statement.
+
+### Column names
+
+`table.columns.add()` names a column in a bulk load, and the name is emitted as a
+quoted identifier. A `]` ends that quoting, so a name holding one must double it,
+which is how T-SQL escapes it:
+
+```javascript
+table.columns.add('a]]b', sql.Int)   // the column named a]b
+```
+
+A single `]` raises `EINJECT`. Column names are not otherwise restricted: spaces,
+punctuation and reserved words are all fine, because the quoting handles them.
+
+The keys of `options.order` are also identifiers, but the driver writes them into the bulk
+statement's `ORDER (...)` clause *unquoted* rather than as `[name]`. They follow the type
+name rule instead: bare, or quoted with brackets or double quotes.
+
+```javascript
+request.bulk(table, { order: { created_at: 'ASC' } })
+request.bulk(table, { order: { '[Created At]': 'DESC' } })   // quote a spaced name yourself
+```
+
+### Type names and sizes
+
+`sql.TVP()` takes the name of a table type, optionally qualified with a schema and
+optionally quoted with brackets or double quotes. A size — the length, precision or
+scale of a type such as `sql.VarChar()` — must be a number, or the word `max` the
+declaration accepts in its place. Padding is trimmed.
+
+```javascript
+request.input('rows', sql.TVP('dbo.[My Type]'), table)
+request.input('name', sql.VarChar(50), value)
+request.input('note', sql.VarChar('max'), value)
+```
+
+A size is checked wherever it is built into SQL, which includes the declaration a
+bulk load sends and the parameter list a query sends, not only `sql.TVP()`.
+
+### Procedure names
+
+`request.execute()` takes the name of a stored procedure, optionally qualified with
+a server, database and schema and optionally quoted with brackets or double quotes.
+An omitted part may be left empty, as T-SQL allows. The `msnodesqlv8` driver builds
+this into the statement it sends; the `tedious` driver sends it as a bound remote
+procedure call and could not be injected through it. Both check it, so a name is
+accepted or rejected the same way whichever driver you use.
+
+```javascript
+request.execute('dbo.[My Procedure]')
+request.execute('master..sp_who')      // an omitted schema is fine
+```
+
+The first and last parts must be present, so `.proc` and `db..` are rejected.
+
+Anything else raises `EINJECT`. Numbered procedures — the deprecated
+`procedure;1` form — are rejected, because the `;` cannot be told apart from the
+end of a statement.
+
+---------------------------------------
+
 ## Errors
 
 There are 4 types of errors you can handle:
@@ -1859,10 +1964,10 @@ Name | Code | Message
 `RequestError` | ECANCEL | Cancelled.
 `RequestError` | ETIMEOUT | Request timeout.
 `RequestError` | EARGS | Invalid number of arguments.
-`RequestError` | EINJECT | SQL injection warning.
+`RequestError` | EINJECT | Parameter name, column name or type is not a valid identifier.
 `RequestError` | ENOCONN | No connection is specified for that request.
 `PreparedStatementError` | EARGS | Invalid number of arguments.
-`PreparedStatementError` | EINJECT | SQL injection warning.
+`PreparedStatementError` | EINJECT | Parameter name is not a valid identifier.
 `PreparedStatementError` | EALREADYPREPARED | Statement is already prepared.
 `PreparedStatementError` | ENOTPREPARED | Statement is not prepared.
 
@@ -2093,8 +2198,6 @@ to create new connections or not
 [downloads-url]: https://www.npmjs.com/package/mssql
 [david-image]: https://img.shields.io/david/tediousjs/node-mssql.svg?style=flat-square
 [david-url]: https://david-dm.org/tediousjs/node-mssql
-[appveyor-image]: https://ci.appveyor.com/api/projects/status/e5gq1a0ujwams9t7/branch/master?svg=true
-[appveyor-url]: https://ci.appveyor.com/project/tediousjs/node-mssql
 
 [tedious-url]: https://www.npmjs.com/package/tedious
 [msnodesqlv8-url]: https://www.npmjs.com/package/msnodesqlv8

package/lib/base/prepared-statement.js

@@ -2,7 +2,7 @@
 
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('events')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { TransactionError, PreparedStatementError } = require('../error')
 const shared = require('../shared')
@@ -91,8 +91,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   input (name, type) {
-    if ((/(--| |\/\*|\*\/|')/).test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -144,8 +144,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   output (name, type) {
-    if (/(--| |\/\*|\*\/|')/.test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -235,17 +235,25 @@ class PreparedStatement extends EventEmitter {
       const req = new shared.driver.Request(this)
       req.stream = false
       req.output('handle', TYPES.Int)
-      req.input('params', TYPES.NVarChar, ((() => {
-        const result = []
+      let params
+      try {
+        params = []
         for (const name in this.parameters) {
           if (!objectHasProperty(this.parameters, name)) {
             continue
           }
           const param = this.parameters[name]
-          result.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
+          // a connection is held here, so a rejected declaration has to be reported
+          // through the path that releases it
+          params.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
         }
-        return result
-      })()).join(','))
+      } catch (e) {
+        this.parent.release(this._acquiredConnection)
+        this._acquiredConnection = null
+        this._acquiredConfig = null
+        return callback(new PreparedStatementError(e, 'EREQUEST'))
+      }
+      req.input('params', TYPES.NVarChar, params.join(','))
       req.input('stmt', TYPES.NVarChar, this.statement)
       req.execute('sp_prepare', (err, result) => {
         if (err) {

package/lib/base/request.js

@@ -3,7 +3,7 @@
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('events')
 const { Readable } = require('stream')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { RequestError, ConnectionError } = require('../error')
 const { TYPES } = require('../datatypes')
@@ -107,8 +107,8 @@ class Request extends EventEmitter {
    */
 
   input (name, type, value) {
-    if ((/(--| |\/\*|\*\/|')/).test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -170,8 +170,8 @@ class Request extends EventEmitter {
   output (name, type, value) {
     if (!type) { type = TYPES.NVarChar }
 
-    if ((/(--| |\/\*|\*\/|')/).test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if ((type === TYPES.Text) || (type === TYPES.NText) || (type === TYPES.Image)) {

package/lib/datatypes.js

@@ -1,5 +1,5 @@
 'use strict'
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeTypeName, assertSafeTypeSize } = require('./utils')
 const inspect = Symbol.for('nodejs.util.inspect.custom')
 
 const TYPES = {
@@ -132,19 +132,33 @@ for (const key in TYPES) {
 }
 
 module.exports.declare = (type, options) => {
+  // sizes and the type name reach the generated declaration directly, so they are checked
+  // here rather than trusted from whatever built the parameter. Each is read only in the
+  // branch that emits it, so a type that takes no size still needs no options.
   switch (type) {
-    case TYPES.VarChar: case TYPES.VarBinary:
-      return `${type.declaration} (${options.length > 8000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.NVarChar:
-      return `${type.declaration} (${options.length > 4000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.Char: case TYPES.NChar: case TYPES.Binary:
-      return `${type.declaration} (${options.length == null ? 1 : options.length})`
-    case TYPES.Decimal: case TYPES.Numeric:
-      return `${type.declaration} (${options.precision == null ? 18 : options.precision}, ${options.scale == null ? 0 : options.scale})`
-    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset:
-      return `${type.declaration} (${options.scale == null ? 7 : options.scale})`
+    case TYPES.VarChar: case TYPES.VarBinary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 8000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.NVarChar: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 4000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.Char: case TYPES.NChar: case TYPES.Binary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length == null ? 1 : length})`
+    }
+    case TYPES.Decimal: case TYPES.Numeric: {
+      const precision = assertSafeTypeSize(options.precision)
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${precision == null ? 18 : precision}, ${scale == null ? 0 : scale})`
+    }
+    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset: {
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${scale == null ? 7 : scale})`
+    }
     case TYPES.TVP:
-      return `${options.tvpType} readonly`
+      return `${assertSafeTypeName(options.tvpType)} readonly`
     default:
       return type.declaration
   }

package/lib/msnodesqlv8/connection-pool.js

@@ -38,8 +38,15 @@ class ConnectionPool extends BaseConnectionPool {
             return this.config.options.trustedConnection ? 'Yes' : 'No'
           case 'encrypt':
             return this.config.options.encrypt ? 'Yes' : 'No'
-          default:
-            return this.config[key] != null ? this.config[key] : ''
+          default: {
+            let val = this.config[key] || ''
+            // quote strings that contain '{' or '}' but not ones that start and end with them (assume they are already quoted)
+            if (val && typeof val === 'string' && !(val.startsWith('{') && val.endsWith('}')) && (val.indexOf('{') !== -1 || val.indexOf('}') !== -1)) {
+              // quote values in `{}` and escape any existing `}` chars
+              val = `{${val.replace(/}/g, '}}')}}`
+            }
+            return val
+          }
         }
       })
 

package/lib/msnodesqlv8/request.js

@@ -4,7 +4,7 @@ const msnodesql = require('msnodesqlv8')
 const debug = require('debug')('mssql:msv8')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare } = require('../datatypes')
 const { PARSERS: UDT } = require('../udt')
 const Table = require('../table')
@@ -154,16 +154,32 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => {
+          assertSafeColumnName(col.name)
+          // This driver hands the column definition to its table manager rather than writing
+          // it into SQL, so a size never reaches a statement here. It is checked all the same,
+          // so that a column either works on both drivers or on neither.
+          assertSafeTypeSize(col.length)
+          assertSafeTypeSize(col.precision)
+          assertSafeTypeSize(col.scale)
+        })
+        // checked here too, so an ordering key is accepted or rejected the same way on
+        // either driver even though this one does not build the statement itself
+        if (options && options.order) {
+          Object.keys(options.order).forEach(key => assertSafeTypeName(key))
+        }
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
 
       if (!table.name) {
-        setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
+        return setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
       }
 
       if (table.name.charAt(0) === '@') {
-        setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
+        return setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
       }
 
       this.parent.acquire(this, (err, connection) => {
@@ -189,8 +205,11 @@ class Request extends BaseRequest {
                 connection.hasError = true
               }
 
+              // a rejected identifier keeps its own code; anything else is a driver
+              // error, whose numeric code must not become the public one
+              const rejectedIdentifier = err.code === 'EINJECT'
               err = new RequestError(err)
-              err.code = 'EREQUEST'
+              err.code = rejectedIdentifier ? 'EINJECT' : 'EREQUEST'
             }
 
             this.parent.release(connection)
@@ -210,14 +229,29 @@ class Request extends BaseRequest {
               }
 
               const rows = []
-              for (const row of Array.from(table.rows)) {
-                const item = {}
-                for (let index = 0; index < table.columns.length; index++) {
-                  const col = table.columns[index]
-                  item[col.name] = row[index]
+              try {
+                for (const col of table.columns) {
+                  // re-checked here for the same reason as the name below, in case the
+                  // definition changed since it was checked above
+                  assertSafeTypeSize(col.length)
+                  assertSafeTypeSize(col.precision)
+                  assertSafeTypeSize(col.scale)
                 }
 
-                rows.push(item)
+                for (const row of Array.from(table.rows)) {
+                  const item = {}
+                  for (let index = 0; index < table.columns.length; index++) {
+                    const col = table.columns[index]
+                    // this driver hands the name to its table manager rather than writing
+                    // it into SQL, but it is checked here all the same: a name either
+                    // works on both drivers or on neither
+                    item[assertSafeColumnName(col.name)] = row[index]
+                  }
+
+                  rows.push(item)
+                }
+              } catch (e) {
+                return done(e)
               }
 
               mgr.insertRows(rows, done)
@@ -232,7 +266,16 @@ class Request extends BaseRequest {
               objectid = table.path
             }
 
-            return connection.queryRaw(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, function (err) {
+            // A connection is held from here on, so a column name that changed since it
+            // was checked above must be reported through `done`, which releases it.
+            let statement
+            try {
+              statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+            } catch (e) {
+              return done(e)
+            }
+
+            return connection.queryRaw(statement, function (err) {
               if (err) { return done(err) }
               go()
             })
@@ -314,12 +357,18 @@ class Request extends BaseRequest {
 
       if (!this._nested) {
         const input = []
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            input.push(`@${param.name} ${declare(param.type, param)}`)
           }
-          const param = this.parameters[name]
-          input.push(`@${param.name} ${declare(param.type, param)}`)
+        } catch (e) {
+          return callback(new RequestError(e, 'EREQUEST'))
         }
 
         const sets = []
@@ -634,14 +683,32 @@ class Request extends BaseRequest {
       if (err) return callback(err)
 
       const params = []
-      for (const name in this.parameters) {
-        if (!objectHasProperty(this.parameters, name)) {
-          continue
-        }
-        const param = this.parameters[name]
-        if (param.io === 2) {
-          params.push(`@${param.name} ${declare(param.type, param)}`)
+      let procedureName
+      try {
+        // this is built into `exec @___return___ = <name>` below and run as SQL text, so it is
+        // checked before it is emitted
+        procedureName = assertSafeProcedureName(procedure)
+        for (const name in this.parameters) {
+          if (!objectHasProperty(this.parameters, name)) {
+            continue
+          }
+          const param = this.parameters[name]
+          if (param.io === 2) {
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            params.push(`@${param.name} ${declare(param.type, param)}`)
+          } else {
+            // An input parameter is bound rather than written into the command, so only an
+            // output parameter's size is declared here and nothing would otherwise check an
+            // input's. It is checked so that a size is accepted or rejected the same way
+            // whichever driver is in use.
+            assertSafeTypeSize(param.length)
+            assertSafeTypeSize(param.precision)
+            assertSafeTypeSize(param.scale)
+          }
         }
+      } catch (e) {
+        return callback(new RequestError(e, 'EREQUEST'))
       }
 
       // set output params w/ values
@@ -657,7 +724,7 @@ class Request extends BaseRequest {
       }
 
       let cmd = `declare ${['@___return___ int'].concat(params).join(', ')};${sets.join(';')};`
-      cmd += `exec @___return___ = ${procedure} `
+      cmd += `exec @___return___ = ${procedureName} `
 
       const spp = []
       for (const name in this.parameters) {

package/lib/table.js

@@ -2,7 +2,7 @@
 
 const TYPES = require('./datatypes').TYPES
 const declareType = require('./datatypes').declare
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeColumnName } = require('./utils')
 
 const MAX = 65535 // (1 << 16) - 1
 const JSON_COLUMN_ID = 'JSON_F52E2B61-18A1-11d1-B105-00805F49916B'
@@ -99,9 +99,9 @@ Table.prototype._makeBulk = function _makeBulk () {
 }
 
 Table.prototype.declare = function declare () {
-  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${col.name}]`)
+  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${assertSafeColumnName(col.name)}]`)
   const cols = this.columns.map(col => {
-    const def = [`[${col.name}] ${declareType(col.type, col)}`]
+    const def = [`[${assertSafeColumnName(col.name)}] ${declareType(col.type, col)}`]
 
     if (col.nullable === true) {
       def.push('null')