- What is mrpowerup/filament-sql-field used for?
- It is a Filament form field that wraps CodeMirror 5 to give admins a SQL editor with syntax highlighting, line numbers, keyword/table/column autocomplete, light/dark theming, and read-only or disabled states. It is intended for presentation only, such as saved-query libraries, ad-hoc support consoles, report authoring, data-quality checks, ETL step definitions, and SQL-backed alert rules. It does not execute SQL or provide authorization, auditing, parameter binding, dialect awareness, or query safety.
- How do I install mrpowerup/filament-sql-field in a Laravel Filament app?
- Install it with Composer, register the field with your Filament panel or resource, and add it to a form schema like any other Filament form component. Then build the surrounding query service if you need a run action, results table, saved-query persistence, or export controls. Check the 2.0.2 Composer constraints and asset-registration method before pinning it in production.
- Does mrpowerup/filament-sql-field execute SQL queries?
- No. The package is a UI field that edits SQL text; the assessment explicitly says it provides no execution, no dialect awareness, no parameter binding, no authorization, no auditing, and no query safety. Any run action, database connection, timeout, row cap, tenant scoping, and audit logging must be delivered by your own backend service. Treat the field as the text box and gate it behind an approved query service.
- Is mrpowerup/filament-sql-field compatible with Filament 5 and Laravel?
- Release 2.0.2 explicitly claims Filament 5 support, which removes the main near-term compatibility objection for teams on the current Filament major. The provided notes do not give a clear matrix for Filament 4, Laravel, PHP, Livewire, or Alpine support, so verify the Composer constraints before pinning. Read the 1.x to 2.x diff for breaking changes to the field's fluent API and published assets.
- Does mrpowerup/filament-sql-field validate SQL syntax or block dangerous statements?
- It provides standard Filament form lifecycle and validation hooks, plus CodeMirror syntax highlighting and autocomplete, but the assessment says it has no dialect awareness, parameter binding, statement-type restriction, or query safety. Syntax highlighting is not server-side validation and must not be trusted as a security control. Add your own SQL parser or allowlist, statement-type restrictions, and parameter binding in the execution service.
- Can I use mrpowerup/filament-sql-field for saved queries, reports, or an internal SQL console?
- Yes, it fits those presentation-tier use cases, including saved-query libraries, ad-hoc ops and support consoles, report and metric authoring, data-quality check configuration, ETL step definitions, and SQL-backed alert rules. You still need to build persistence, a run action, a results table, export controls, and permissions around it. Start with a read-only replica and role-gated visibility rather than a production primary.
- What security controls do I need before letting admins run SQL with this field?
- Authenticate the actor and authorize each SQL action, then validate statements against an approved dialect, statement type, and parameter-binding policy. Execute only against an approved connection, preferably a read-only replica, with statement timeouts, row caps, and tenant or row scoping. Log every execution and add an approval flow for high-risk operations. The package supplies none of these controls, so do not ship raw SQL access without them.
- Can I customize the CodeMirror SQL editor theme, autocomplete, and read-only state?
- The field provides light and dark theming to match the Filament panel, keyword/table/column autocomplete, line numbers, and read-only or disabled states. Exact configuration keys and asset publishing behavior are not fully documented in the available notes, so inspect the package source and test local overrides. Keep customization behind the field contract so a future CodeMirror 6 or Monaco migration stays cheap.
- Is mrpowerup/filament-sql-field actively maintained, and what are the alternatives?
- The February 2026 2.0.2 release is a positive maintenance signal, but the project has 18 stars, zero dependents, a single maintainer, no vendor, and no SLA, so community risk is moderate to high. CodeMirror 5 is a legacy major version, so assume an eventual editor migration. Alternatives include a custom CodeMirror 6 or Monaco field, a general Filament code-editor field, or a dedicated internal SQL console with stronger guardrails.
- How should I test the SQL field and its CodeMirror assets in a Laravel app?
- Test form state binding, Filament validation, read-only and disabled behavior, light/dark theming, and asset loading under your CSP. Verify keyboard navigation, mobile browser behavior, and screen-reader posture because the embedded CodeMirror 5 accessibility is unverified. Test execution, authorization, timeouts, row caps, and audit logging separately in the backend query service.