3 ms·
My point is that every SQL API allows that as a fallback simply because they can't stop it. So basically, if your proper, official, "this is how you should do
by Pxtl 11y ago
My point is that every SQL API allows that as a fallback simply because they can't stop it. So basically, if your proper, official, "this is how you should do it" API sucks, users will fallback to mashing strings together.
Doubly true for dynamic SQL, for those people who are "everything must be done in procs" types.
- vetinari 11y agoSQL is not an API. SQL is a language. It doesn't care how you came up with your statements. If you concatenate strings, that's your private business.
- Pxtl 11y agoSQL Servers have an API for a client language, and often they are extremely cumbersome for prepared statements. Not to mention that in many cases this "language" has no coherent way to say the obvious operation of "Escape all the control characters in this string". If you don't offer that, your language sucks.
- vetinari 11y agoThere are multiple APIs - from ODBC, ADODB to DB-API for Python or database-specific client libraries. They describe how to send SQL to the server, but they are not SQL and the SQL is not the API. Different layer.