@@ -10,15 +10,9 @@ const SQL_OPERATORS: Record<string, string> = {
1010 lessThan : "<" ,
1111 lessThanOrEqual : "<=" ,
1212 contains : "LIKE" ,
13- notContains : "NOT LIKE" ,
1413 startsWith : "LIKE" ,
15- notStartsWith : "NOT LIKE" ,
16- in : "IN" ,
17- notIn : "NOT IN" ,
18- isNull : "IS NULL" ,
19- isNotNull : "IS NOT NULL" ,
20- isEmpty : "= ''" ,
21- isNotEmpty : "!= ''" ,
14+ isEmpty : "IS NULL" ,
15+ isNotEmpty : "IS NOT NULL" ,
2216 before : "<" ,
2317 after : ">" ,
2418} ;
@@ -59,18 +53,18 @@ function transformSingleFilter(filter: SingleFilter): string | null {
5953 return `${ path } ${ operator } (${ items } )` ;
6054 }
6155
62- // Unary operators (IS NULL, IS NOT NULL, = '', != '')
56+ // Unary operators
6357 if ( value === undefined ) {
6458 return `${ path } ${ operator } ` ;
6559 }
6660
6761 // LIKE patterns for contains/startsWith
6862 if ( typeof value === "string" ) {
6963 const escaped = escapeSQL ( value ) ;
70- if ( filter . name === "contains" || filter . name === "notContains" ) {
64+ if ( filter . name === "contains" ) {
7165 return `${ path } ${ operator } '%${ escaped } %'` ;
7266 }
73- if ( filter . name === "startsWith" || filter . name === "notStartsWith" ) {
67+ if ( filter . name === "startsWith" ) {
7468 return `${ path } ${ operator } '${ escaped } %'` ;
7569 }
7670 return `${ path } ${ operator } '${ escaped } '` ;
@@ -106,6 +100,10 @@ function transformFilterGroup(filterGroup: FilterGroup): string | null {
106100/**
107101 * Transforms a FilterGroup object into a SQL WHERE clause.
108102 *
103+ * WARNING: This is for demonstration purposes only. The output uses string
104+ * concatenation and is NOT safe against SQL injection. In production, always
105+ * use parameterized queries or prepared statements.
106+ *
109107 * @example
110108 * ```ts
111109 * filterRuleToSQL({
@@ -120,6 +118,8 @@ function transformFilterGroup(filterGroup: FilterGroup): string | null {
120118 * })
121119 * // "WHERE (title = 'hello world')"
122120 * ```
121+ *
122+ * @deprecated This function is for demonstration purposes only and should not be used in production due to SQL injection risks. Always use parameterized queries or prepared statements in real applications.
123123 */
124124export const filterRuleToSQL = ( filterGroup : FilterGroup ) => {
125125 const where = transformFilterGroup ( filterGroup ) ;
0 commit comments