StatementSync

This class represents a single prepared statement. This class cannot be instantiated via its constructor. Instead, instances are created via the database.prepare() method. All APIs exposed by this class execute synchronously.

A prepared statement is an efficient binary representation of the SQL used to create it. Prepared statements are parameterizable, and can be invoked multiple times with different bound values. Parameters also offer protection against SQL injection attacks. For these reasons, prepared statements are preferred over hand-crafted SQL strings when handling user input.

The all(), get(), iterate(), and run() methods bind their arguments to the parameters of the prepared statement before executing it. Parameters are either anonymous or named.

Anonymous parameters are written as ? in SQL and are bound in order from the arguments passed to the method. The ?NNN form assigns SQLite parameter index NNN to a placeholder. Avoid mixing numbered and named parameters because they share parameter indexes.

db.prepare('SELECT ? AS a, ? AS b').get('x', 42);
// { a: 'x', b: 42 }
db.prepare('SELECT ?2 AS a, ?1 AS b').get('first', 'second');
// { a: 'second', b: 'first' }

Named parameters begin with one of the prefix characters $, :, or @ in SQL. They are bound from an object passed as the first argument. Repeating a name in the SQL binds the same value to every occurrence.

db.prepare('SELECT $a AS a, $b AS b').get({ $a: 1, $b: 2 });
// { a: 1, b: 2 }
db.prepare('SELECT :a AS a').get({ ':a': 1 });
// { a: 1 }
db.prepare('SELECT @a AS a').get({ '@a': 1 });
// { a: 1 }
db.prepare('SELECT $k AS a, $k AS b').get({ k: 7 });
// { a: 7, b: 7 }

The last example omits the prefix character from the object key. Bare names are allowed by default; see statement.setAllowBareNamedParameters() for their caveats.

Binding a key that does not name a parameter of the statement throws an ERR_INVALID_STATE error unless unknown named parameters are ignored. See statement.setAllowUnknownNamedParameters().

See Type conversion between JavaScript and SQLite for the values that can be bound. Binding any other value throws an ERR_INVALID_ARG_TYPE error.

statement.all(namedParameters?, ...anonymousParameters?): Array

This method executes a prepared statement and returns all results as an array of objects. If the prepared statement does not return any results, this method returns an empty array. The prepared statement parameters are bound using the values in namedParameters and anonymousParameters. See Binding parameters.

statement.close(): void

Finalizes the prepared statement. An exception is thrown if the statement is already finalized. An ERR_INVALID_STATE error is thrown if this statement is currently executing, which happens when the method is called from a callback that the statement itself triggered, such as a user-defined function, an aggregate function, or a 'sqlite.db.query' subscriber. Idle statements on the same connection can be finalized from such a callback. This method is a wrapper around sqlite3_finalize().

statement.columns(): Array

This method is used to retrieve information about the columns returned by the prepared statement.

The source SQL text of the prepared statement with parameter placeholders replaced by the values that were used during the most recent execution of this prepared statement. This property is a wrapper around sqlite3_expanded_sql().

statement.get(namedParameters?, ...anonymousParameters?): Object | undefined

This method executes a prepared statement and returns the first result as an object. If the prepared statement does not return any results, this method returns undefined. The prepared statement parameters are bound using the values in namedParameters and anonymousParameters. See Binding parameters.

statement.iterate(namedParameters?, ...anonymousParameters?): Iterator

This method executes a prepared statement and returns an iterator of objects. If the prepared statement does not return any results, this method returns an empty iterator. The prepared statement parameters are bound using the values in namedParameters and anonymousParameters. See Binding parameters.

statement.resetStats(): void

Resets every counter reported by statement.stat() back to zero, except memused, which reports current memory usage and cannot be reset. This method is a wrapper around sqlite3_stmt_status() and is useful for measuring a specific workload without the counts accumulated by earlier executions of the same prepared statement.

statement.run(namedParameters?, ...anonymousParameters?): Object

This method executes a prepared statement and returns an object summarizing the resulting changes. The prepared statement parameters are bound using the values in namedParameters and anonymousParameters. See Binding parameters.

statement.setAllowBareNamedParameters(enabled): void

The names of SQLite parameters begin with a prefix character. However, with the exception of the dollar sign character, these prefix characters also require extra quoting when used in object keys.

To improve ergonomics, node:sqlite allows bare named parameters, which do not require the prefix character in JavaScript code, by default. This method can be used to disable that behavior, requiring the prefix character when binding. There are several caveats to be aware of when bare named parameters are allowed:

• The prefix character is still required in SQL.
• The prefix character is still allowed in JavaScript. In fact, prefixed names will have slightly better binding performance.
• Using ambiguous named parameters, such as $k and @k, in the same prepared statement will result in an exception as it cannot be determined how to bind a bare name.

statement.setAllowUnknownNamedParameters(enabled): void

By default, if an unknown name is encountered while binding parameters, an exception is thrown. This method allows unknown named parameters to be ignored.

statement.setReturnArrays(enabled): void

When enabled, query results returned by the all(), get(), and iterate() methods will be returned as arrays instead of objects.

statement.setReadBigInts(enabled): void

When reading from the database, SQLite INTEGERs are mapped to JavaScript numbers by default. However, SQLite INTEGERs can store values larger than JavaScript numbers are capable of representing. In such cases, this method can be used to read INTEGER data using JavaScript BigInts. This method has no impact on database write operations where numbers and BigInts are both supported at all times.

The source SQL text of the prepared statement. This property is a wrapper around sqlite3_sql().

statement[Symbol.dispose](): void

Finalizes the prepared statement. If the prepared statement is already finalized, then this is a no-op. An ERR_INVALID_STATE error is thrown if this statement is currently executing, under the same conditions as statement.close().

stat(counter): number

Returns one of the runtime counters that SQLite tracks for this prepared statement. This method is a wrapper around sqlite3_stmt_status() and does not reset the counter. Asserting that a statement does not perform a full table scan (statement.stat('fullscanStep') === 0) is a useful check to guard against degenerate performance.

The 'filterMiss' and 'filterHit' counters require SQLite 3.38.0 or later. Builds linked against an older SQLite with --shared-sqlite do not expose them, and passing either name throws ERR_INVALID_ARG_VALUE.