Method executeSQL

src/connectors/sqlserver/index.ts:609–703

(sqlQuery: string, options: ExecuteOptions, parameters?: any[])

  }

  async executeSQL(sqlQuery: string, options: ExecuteOptions, parameters?: any[]): Promise<SQLResult> {
    if (!this.connection) {
      throw new Error("Not connected to SQL Server database");
    }

    // SQL Server has no native EXPLAIN statement. Translate a leading `EXPLAIN`
    // into a SHOWPLAN_XML request so callers get a Postgres/MySQL-like
    // experience. SHOWPLAN_XML compiles the statement without executing it, so
    // this is read-only safe (further enforced in explainQuery).
    const afterNoise = sqlQuery.slice(
      sqlQuery.match(SQLServerConnector.LEADING_NOISE)![0].length
    );
    if (/^explain\b/i.test(afterNoise)) {
      return this.explainQuery(afterNoise.slice("explain".length).trim());
    }

    try {
      // Apply maxRows limit to SELECT queries if specified
      let processedSQL = sqlQuery;
      if (options.maxRows) {
        processedSQL = SQLRowLimiter.applyMaxRowsForSQLServer(sqlQuery, options.maxRows);
      }

      // Engine-level read-only enforcement: SQL Server has no
      // BEGIN TRANSACTION READ ONLY, so we wrap in a transaction and
      // unconditionally ROLLBACK to prevent any modifications from persisting.
      // This is defense-in-depth behind the keyword classifier.
      if (options.readonly) {
        return await this.executeReadOnly(processedSQL, parameters);
      }

      // Create request and collect informational messages (e.g. SET STATISTICS TIME/IO, PRINT)
      const request = this.connection.request();
      const messages: DatabaseMessage[] = [];
      request.on(
        'info',
        (info: { message: string; number?: number; class?: number; lineNumber?: number }) => {
          messages.push({
            text: info.message,
            // SQL Server reports severity as a numeric class; info messages are < 10.
            severity: info.class !== undefined ? String(info.class) : undefined,
            code: info.number,
            line: info.lineNumber,
          });
        }
      );

      if (parameters && parameters.length > 0) {
        // SQL Server uses @p1, @p2, etc. for parameters
        parameters.forEach((param, index) => {
          const paramName = `p${index + 1}`;
          // Infer SQL Server type from JavaScript type
          if (typeof param === 'string') {
            request.input(paramName, sql.VarChar, param);
          } else if (typeof param === 'number') {
            if (Number.isInteger(param)) {
              request.input(paramName, sql.Int, param);
            } else {