# SQL `deft/stdext/sql` implements the `[sql … \sql]` interpolated block. It escapes every interpolated part type-aware (numbers bare, strings quoted with `''` doubling, `nil` as `NULL`, vectors as tuples, maps as `col = val` conjunctions) and returns a plain query string — the counterpart to HTML for database queries.

from "deft/stdext/sql" import @{ sql sql-raw }

## API | Def | Signature | Description | |---|---|---| | `sql` | `{| block |}` | Block handler: escapes and joins the parsed parts, returns the query string. | | `sql-raw` | `{| value |}` | Marks a fragment as trusted SQL — emitted verbatim. | | `sql-escape-value` | `{| val |}` | Escapes one Deft value to a SQL literal. | | `sql-escape-part` | `{| part |}` | Escapes one block part (`__SqlSafe` passes through). | Escaping rules: | Value | Rendered | |---|---| | `nil` | `NULL` | | number | bare (`42`) | | bool | `TRUE` / `FALSE` | | string | `'it''s'` (single quotes doubled) | | vector/list | `(a, b, 'c')` | | map | `"col" = 'val' AND …` | ## Example

def name "O'Brien"
set query [sql
    SELECT * FROM users
    WHERE name = $name AND updated_at > [sql-raw "NOW() - INTERVAL '1 day'"]
\sql]
set rows [sqlite/query $db $query]

Use `[sql-raw …]` only for fragments you control (function calls, keywords); everything user-supplied belongs in the interpolated parts. ## See Also - HTML — the reference implementation of a block handler - SQLite — the `sqlite/*` stdlib namespace - Postgres — the `pg/*` namespace