3 ms·
Maybe I'm missing something, but that looks like SQL Injection ready to happen.
by tonyarkles 10y ago
Maybe I'm missing something, but that looks like SQL Injection ready to happen.
- tracker1 10y agosql.query is a function that will receive two arrays, one is the strings part, the other is the injected values... the template processor takes those arrays and turns it into a parameterized query to the database.
- tonyarkles 10y agoVery cool! In that example though... where's the array? And don't backticks do string interpolation?
- sime2009 10y agoBackticks by themselves will do string interpolation. But backticks with a function name in front will do something a bit different. In this case 'sql.query' is a function and the JS will pass it an array which represents the contents of the backtick string. There the function can do what it likes and return a result. 'sql.query' builds a proper (and safe!) SQL query and executes it. The backtick feature in ES2015 is really cool and allows for some great DSL type features.
- tonyarkles 10y agoNeat! Thanks for the awesome explanation!
- alxndr 10y agoThis feature is apparently called "tagged template strings"; more on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#Tagged_template_literals https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...