Function escape

lib/sql-string.js:21–93

(val, timeZone, dialect, format)

exports.arrayToList = arrayToList;

function escape(val, timeZone, dialect, format) {
  let prependN = false;
  if (val === undefined || val === null) {
    return class="st">'NULL';
  }
  switch (typeof val) {
    case class="st">'boolean':
    class="cm">// SQLite doesn't have true/false support. MySQL aliases true/false to 1/0
    class="cm">// for us. Postgres actually has a boolean type with true/false literals,
    class="cm">// but sequelize doesn't use it yet.
      if ([class="st">'sqlite', class="st">'mssql'].includes(dialect)) {
        return +!!val;
      }
      return (!!val).toString();
    case class="st">'number':
      return val.toString();
    case class="st">'string':
    class="cm">// In mssql, prepend N to all quoted vals which are originally a string (for
    class="cm">// unicode compatibility)
      prependN = dialect === class="st">'mssql';
      break;
  }

  if (val instanceof Date) {
    val = dataTypes[dialect].DATE.prototype.stringify(val, { timezone: timeZone });
  }

  if (Buffer.isBuffer(val)) {
    if (dataTypes[dialect].BLOB) {
      return dataTypes[dialect].BLOB.prototype.stringify(val);
    }

    return dataTypes.BLOB.prototype.stringify(val);
  }

  if (Array.isArray(val)) {
    const partialEscape = escVal => escape(escVal, timeZone, dialect, format);
    if (dialect === class="st">'postgres' && !format) {
      return dataTypes.ARRAY.prototype.stringify(val, { escape: partialEscape });
    }
    return arrayToList(val, timeZone, dialect, format);
  }

  if (!val.replace) {
    throw new Error(`Invalid value ${logger.inspect(val)}`);
  }

  if ([class="st">'postgres', class="st">'sqlite', class="st">'mssql', class="st">'snowflake', class="st">'db2'].includes(dialect)) {
    class="cm">// http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
    class="cm">// http://stackoverflow.com/q/603572/130598
    val = val.replace(/class="st">'/g, "''");

    if (dialect === class="st">'postgres') {
      class="cm">// null character is not allowed in Postgres
      val = val.replace(/\0/g, class="st">'\\0');
    }
  } else {