namedPlaceholders only works for values, not for MySQL identifiers

[aaloman]

Are there any MySQL identifiers like below like ::column and ::direction

const [rows] = await connection.query(
   `SELECT * FROM users
    WHERE id = :id
    AND status = :status
    ORDER BY ::column :direction`,
    { id: 14, status: 'active', column: 'username', direction: 'ASC' }
)

[official-burak]

There is no ::column form. namedPlaceholders runs named-placeholders, which only rewrites :name value binds into ?. Identifiers are not parameters in MySQL.

Build ORDER BY yourself and whitelist the direction:

const direction = String(opts.direction).toUpperCase() === "DESC" ? "DESC" : "ASC"
const sql = `SELECT * FROM users
  WHERE id = :id AND status = :status
  ORDER BY ${connection.escapeId(opts.column)} ${direction}`
const [rows] = await connection.query(sql, { id: 14, status: "active" })

escapeId quotes the column. Do not put ASC/DESC in a bound value.