import { simpleSqlName, qualifiedSqlName, noop } from "sql-assert";

// returns a valid SQL name or throws an error
const stmt1 = `select count(*) from ${simpleSqlName(tableName)}`;
const stmt2 = `select count(*) from ${qualifiedSqlName(tableName)}`;

// no operation, returns original value
// SQL injection is possible, e.g., if `tableName` is a function parameter
const stmt3 = `select count(*) from ${noop(tableName)}`;

import sql, { raw } from "sql-template-tag";
import { simpleSqlName, qualifiedSqlName } from "sql-assert";

// throws an error if tableName or columnName is not syntactically valid
// columnValue is a bind variable, hence no SQL injection is possible
const query = sql`select count(*) 
                    from ${raw(qualifiedSqlName(tableName))} 
                   where ${raw(simpleSqlName(columnName))} = ${columnValue}`;