String.raw, SQL parameters and money formatting
The sql tag never puts the name into the query text, so a quote in O'Brien can't break it: the database receives the values separately. (String.raw is ES2015 too.)
Putting a function name right before a template literal, as in tagHi ${name}, calls that function with the literal's fixed text parts and its values separately, so it can escape, format or reshape them before building the result; String.raw is the built-in tag that keeps backslashes as written.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 5 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write a tag highlight that wraps every substitution value in <mark> and </mark> (escaping is not needed for this task). Log ` highlightFound ${3} results for ${"tea"} `.
Use String.raw to build a regex that matches a Windows path starting with C:\Users\, and test it on C:\Users\asha.
Explain it without notes
What arguments does a tag function receive? How many strings and values are there?
What is the difference between strings[i] and strings.raw[i], and what does String.raw do?
How can a tagged template help prevent XSS or SQL injection?
Preview
Console
Nothing logged yet.Expected console output
C:\new\table
true
\d+\.\d+
true
SELECT * FROM users WHERE name = $1 AND age > $2
[ 'O\'Brien', 30 ]
Total ₹1,23,456.79 after a -₹100.00 discount