timgws/query-builder-parser
Parse jQuery QueryBuilder rules into Laravel/Illuminate query builder constraints. Safely whitelist allowed fields, then generate SQL queries (and MongoDB queries via jenssegers/mongodb) for filtering results in apps and integrations like DataTables.
composer require timgws/query-builder-parser
use timgws\QueryBuilderParser;
use Illuminate\Support\Facades\DB;
$qbp = new QueryBuilderParser(['name', 'email']); // Whitelist allowed fields
$query = $qbp->parse($request->input('querybuilder'), DB::table('users'));
$results = $query->get();
Dynamic filtering for a user management dashboard:
active status, text inputs for name, and dropdowns for role.QueryBuilderParser to generate SQL.const rules = $('#querybuilder').queryBuilder('getRules');
$.post('/admin/users/filter', { querybuilder: JSON.stringify(rules) });
$qbp = new QueryBuilderParser(['id', 'name', 'email']);
$query = $qbp->parse($request->querybuilder, DB::table('users'));
return Datatable::query($query)
->showColumns(['id', 'name', 'email'])
->make();
fnServerParams to pass QueryBuilder rules to Laravel:
oTable = $('.datatable').DataTable({
"serverSide": true,
"ajax": {
"url": "/admin/users",
"data": function(d) {
d.querybuilder = JSON.stringify($('#querybuilder').queryBuilder('getRules'));
}
}
});
DB::table() with DB::collection() and ensure jenssegers/mongodb is installed.QueryBuilderParser to prevent SQL injection:
$qbp = new QueryBuilderParser(['safe_column1', 'safe_column2']);
JoinSupportingQueryBuilderParser for complex relationships:
$joinFields = [
'user_orders' => [
'from_table' => 'users',
'from_col' => 'id',
'to_table' => 'orders',
'to_col' => 'user_id',
]
];
$jsqbp = new JoinSupportingQueryBuilderParser(['name'], $joinFields);
$query = $jsqbp->parse($rules, DB::table('users'));
NOT BETWEEN) by extending the parser or using the built-in support:
// Automatically supported in v1.5+
$rules = ['field' => 'price', 'operator' => 'not_between', 'value' => [100, 500]];
Field Whitelisting:
QueryBuilderParser constructor.$qbp = new QueryBuilderParser(['id', 'name']); // Only these fields are queryable
SQLSTATE[42S22]: Column not found errors if unwhitelisted fields are used.Operator Mismatches:
begins_with/ends_with operators may behave counterintuitively (fixed in v1.1.2).contains for partial matches or verify operator logic in custom rules.MongoDB Quirks:
\ escapes in MongoDB).jenssegers/mongodb for proper escaping.Date Handling:
date_format config matches your frontend date inputs.\Log::debug('QueryBuilder Rules:', ['rules' => $request->querybuilder]);
$toSql = $query->toSql();
$bindings = $query->getBindings();
\Log::debug($toSql, $bindings);
[]).NULL values (is_null/is_not_null).OR groups).QueryBuilderParser to add support for domain-specific operators:
class CustomQueryBuilderParser extends QueryBuilderParser {
protected function registerCustomOperators() {
$this->operators['custom_op'] = function ($query, $field, $value) {
$query->where($field, 'LIKE', "%{$value}%");
};
}
}
$query = $qbp->parse($rules, $builder);
$query->select(['id', 'name']); // Add custom selections
parse method to handle MongoDB-specific logic (e.g., $lookup for joins).app()->make('db') for dependency injection:
$qbp = new QueryBuilderParser(['name'], app()->make('db'));
config(['app.timezone' => 'UTC'])).with() or eager loading if relationships are queried.$qbp = new QueryBuilderParser(['active', 'created_at']);
$query = $qbp->parse($rules, DB::table('users'));
$results = $query->get(); // Reuse $query for pagination/sorting
How can I help you explore Laravel packages today?