I want to URL encode this:

SELECT name FROM user WHERE uid = me() 

Do I have to download a module for this? I already have the request module.

  • 8
    Indeed, this is a slippy road and should be avoided at all costs. – Alfred Jul 2 '11 at 0:23
  • 23
    Are you trying to put SQL statement in your url??? be careful of the SQL Injection Attack! It's generally a bad idea to expose SQL to the users, it's really dangerous. – Leonmax Aug 21 '12 at 16:03
  • 5
    @LightnessRacesinOrbit: looks like an FQL-query. – nikc.org Sep 21 '12 at 7:19
  • 2
    @Demi: No? How would that work. DBMS permissions are not sufficiently fine-grained, even if every single SO user got their own DB account. Tell me where on SO you see SQL queries passed directly? The one exception is data explorer, but that's all read-only views, and it's certainly not put in the URL. – Lightness Races in Orbit Feb 12 '17 at 16:57
  • 19
    The guy could be building an SQL validation tool, nothing wrong with passing SQL commands in an example like that. Too much focus on not answering the question neither giving good advice (the most upvoted comment doesn't give good advice, only makes fun of the OP) – Rafael Eyng May 14 '18 at 19:37

You can use JavaScript's encodeURIComponent:

encodeURIComponent('select * from table where i()')


  • 46
    To save visitors a search, yes... decodeURIComponent is how you decode the encoded URI. You're welcome. – KyleFarris Apr 2 '19 at 19:41

The built-in module querystring is what you're looking for:

var querystring = require("querystring");
var result = querystring.stringify({query: "SELECT name FROM user WHERE uid = me()"});
#prints 'query=SELECT%20name%20FROM%20user%20WHERE%20uid%20%3D%20me()'
  • 4
    in this case we can only pass a map not a string, so if arg is a string then you will see nothing in result. So if you have strings to encode use encodeURIComponent(). – Ankit Patial Jul 31 '13 at 6:46
  • 1
    This is better for encoding JSON objects and POST-ing them. – Alex W Dec 20 '15 at 16:53
  • Not if the string contains ' or " characters – Jkarttunen Sep 16 '16 at 21:48

Use the escape function of querystring. It generates a URL safe string.

var escaped_str = require('querystring').escape('Photo on 30-11-12 at 8.09 AM #2.jpg');
// prints 'Photo%20on%2030-11-12%20at%208.09%20AM%20%232.jpg'
  • 1
    This definitely appears to be the correct function; querystring.stringify() (in Nicolas' answer) seem to return an empty string now. – brandonscript May 13 '16 at 18:18
  • 5
    nodejs.org/api/… says: "The querystring.escape() method is used by querystring.stringify() and is generally not expected to be used directly." – Simon Hänisch Aug 18 '17 at 1:24

Note that URI encoding is good for the query part, it's not good for the domain. The domain gets encoded using punycode. You need a library like URI.js to convert between a URI and IRI (Internationalized Resource Identifier).

This is correct if you plan on using the string later as a query string:

> encodeURIComponent("http://examplé.org/rosé?rosé=rosé")

If you don't want ASCII characters like /, : and ? to be escaped, use encodeURI instead:

> encodeURI("http://examplé.org/rosé?rosé=rosé")

However, for other use-cases, you might need uri-js instead:

> var URI = require("uri-js");
> URI.serialize(URI.parse("http://examplé.org/rosé?rosé=rosé"))

encodeURIComponent(string) will do it:

encodeURIComponent("Robert'); DROP TABLE Students;--")
//>> "Robert')%3B%20DROP%20TABLE%20Students%3B--"

Passing SQL around in a query string might not be a good plan though,

see this one

