4 ms·
To me this is a failing of popular SQL APIs that don't provide a good way to escape characters and force you to either deal with horribly clumsy prepared statem
by Pxtl 11y ago
To me this is a failing of popular SQL APIs that don't provide a good way to escape characters and force you to either deal with horribly clumsy prepared statement APIs or just concatenate strings together.
- jameshart 11y agoWhich popular SQL APIs force you to concatenate strings together? That is terrifying.
- Pxtl 11y agoMy point is that every SQL API allows that as a fallback simply because they can't stop it. So basically, if your proper, official, "this is how you should do it" API sucks, users will fallback to mashing strings together. Doubly true for dynamic SQL, for those people who are "everything must be done in procs" types.
- vetinari 11y agoSQL is not an API. SQL is a language. It doesn't care how you came up with your statements. If you concatenate strings, that's your private business.
- Pxtl 11y agoSQL Servers have an API for a client language, and often they are extremely cumbersome for prepared statements. Not to mention that in many cases this "language" has no coherent way to say the obvious operation of "Escape all the control characters in this string". If you don't offer that, your language sucks.
- vetinari 11y agoThere are multiple APIs - from ODBC, ADODB to DB-API for Python or database-specific client libraries. They describe how to send SQL to the server, but they are not SQL and the SQL is not the API. Different layer.
- Sean1708 11y agoCan you give some examples of horribly clumsy prepared statement APIs? Every DB API I've ever used has looked like query("INSERT INTO table VALUES (?1, ?2, ?3)", "a", "b", "c") or something more like insert_into("table").values("a", "b", "c") neither if which seem horrible or clumsy to me.
- Pxtl 11y agoIt gets painful when the SQL gets complicated, like if you're assembling the query dynamically, or if you need to pass in an array-like object. For example, imagine if you're using a multi-select GUI object as a filter. How do you load in the selected items to filter the result set?