Server: ident

Quote a Postgres identifier — a table, column, or role name — for safe interpolation into SQL text.

Bind parameters cover values and nothing else: order by $1 sorts every row by the constant string $1, and select $1 from t selects a literal, not a column. Identifiers therefore have to reach the server as SQL text, which is the one place string-building is unavoidable. This makes that step safe by quoting the name and doubling any embedded quote, so the result is always exactly one identifier no matter what it contains.

It is not an allowlist. Quoting a caller-supplied name yields a valid identifier, not a permitted one — ident(req.query.sort) cannot inject SQL but can still read a column the caller was never meant to see. Check the name against a fixed set you control first, then quote it.

Parameters

• name

  (Required)

  The identifier to quote.

Examples

Example 1

const SORTABLE = new Set(['created_at', 'title'])
if (!SORTABLE.has(column)) throw new Error('unsupported sort column')
const rows = await ctx.postgres.queryRaw(
  `select id, title from posts order by ${ident(column)} desc`,
)