queryRaw doesn't support dynamic tables names

Bug description

const values = await prisma.$queryRaw`SELECT type FROM ${collection};`; fails with the error

Message: `db error: ERROR: syntax error at or near "$1"

However, const values = await prisma.$queryRawUnsafe(`SELECT type FROM ${collection};`); works fine.

Does anyone know why this occurs? I need to be able to be use the safe version to prevent SQL injection in my app 😕

How to reproduce

Raw query a postgres database with a dynamic table name.

Expected behavior

No response

Prisma information

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}

model spacebudz {
  type              String?
}

Environment & setup

• OS: Mac OS
• Database: PostgreSQL
• Node v16.10.10

Prisma Version

3.2.1

[MilesConn]

I actually found a solution to this that’s slightly safer imo than $queryRawUnsafe which is you can wrap the table name with const tableArg = Prisma.raw(tableName) and then use tableArg. This makes things slightly safer as its easier to validate the tableName than the entire string.

[dydent]

@MilesConn

I actually found a solution to this that’s slightly safer imo than $queryRawUnsafe which is you can wrap the table name with const tableArg = Prisma.raw(tableName) and then use tableArg. This makes things slightly safer as its easier to validate the tableName than the entire string.

This is a great and quick fix that actually worked for me:

Just wrap your inserted variable with Prisma.raw() and it should work.

In this context: const values = await prisma.$queryRaw SELECT type FROM ${Prisma.raw(collection)}; should do the job!