Slonik
Opinionated PostgreSQL client for Node.js that enforces best practices. Slonik uses tagged template literals (sql`SELECT * FROM table`) with automatic parameterization — preventing SQL injection by design. Forces use of bound parameters for all values. Supports connection pooling, interceptors for logging/monitoring, type-safe query results with TypeScript, and strict result handling.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
SQL injection prevention is a core design principle — tagged template literals make parameterized queries the only API. TLS support. BSD licensed.
⚡ Reliability
Best When
You want to write raw SQL with type safety and SQL injection prevention by design — Slonik's tagged template approach makes parameterization the only way to include values.
Avoid When
You want ORM abstractions or query builders — Drizzle/Prisma are better. For non-PostgreSQL databases, use appropriate clients.
Use Cases
- • Write type-safe PostgreSQL queries in TypeScript with automatic SQL injection prevention via tagged template literals
- • Build agent database layers with enforced parameterization — Slonik makes SQL injection structurally impossible
- • Add query logging, performance monitoring, and error transformation via Slonik's interceptor system
- • Manage PostgreSQL connection pools with fine-grained control over pool size, idle timeout, and connection validation
- • Use alongside Prisma or Drizzle for complex raw SQL queries that ORM query builders can't express
Not For
- • ORM-style active record or migrations — use Prisma or Drizzle for full ORM capabilities
- • Non-PostgreSQL databases — Slonik is PostgreSQL-only
- • Teams preferring query builder syntax over raw SQL — Knex or Kyselys offer query builder APIs
Interface
Authentication
PostgreSQL connection URL authentication. TLS/SSL support via connection options.
Pricing
BSD-licensed open source library.
Agent Metadata
Known Gotchas
- ⚠ Slonik uses ESM exclusively in recent versions — CommonJS require() fails; ensure build/runtime supports ESM
- ⚠ sql tag must wrap all query fragments — concatenating sql tagged template literals requires sql.join() or sql.fragment(); raw string concatenation causes TypeScript errors
- ⚠ Result type expectations are strict — one() throws if no rows returned, many() throws if empty; use maybeOne() or any() for nullable results
- ⚠ Interceptors modify all queries — performance monitoring interceptors that log all queries can add overhead; use conditional logging based on query duration
- ⚠ Slonik's TypeScript types require explicit result type annotations — sql<{id: number, name: string}>`SELECT id, name FROM users`
- ⚠ Connection pool is created at startup — pool creation errors (wrong credentials, unreachable DB) throw at createPool() time, not at query time
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Slonik.
Scores are editorial opinions as of 2026-03-06.