LEFT OUTER JOIN with many criterias. One of the criterias is comparing with a string.

I need to write a MySQL query like this:

SELECT *
FROM student LEFT OUTER JOIN student_languages
              ON student.id = student_languages.student_id
              AND student_languages.code = 'en_US'

I achieved it with the following code:

Knex('student')
.join('student_languages', ->
    @type('left outer')
    .on(    'student.id',           '=',    'student_languages.student_id')
    .andOn( 'student_languages.code',   '=',    Knex.raw('\'' + languageCode + '\''))
)
.select()

Knex.raw(‘'’ + languageCode + ‘'’)) allow the languageCode to be recognized as a string.

AND `student_languages`.`code` = 'en_US'

If I obmit Knex.raw, string value of languageCode is understood as a column name which is not what I need.

AND `student_languages`.`code` = `en_US`

However, the problem is with the usage of Knex.raw which leaves potential SQL injection.

Is there a non SQL-injection exposure way to achieve what I need?

[boutell]

Is this still the only way to do a simple equality test with something like a string in an “on” clause? I see I can do “onIn”, so that’s a workaround, but surely I should also be able to compare with a simple value without using “in”?

[boutell]

Perhaps onScalar, since I understand it would not be practical to detect the difference between .on with a column name and .on with a string.