2 ms·
SQL actually demonstrates a good use case for custom template handlers. It's not SQL, but we're using a template handler to make writing parameterized queries t
by pluma 10y ago
SQL actually demonstrates a good use case for custom template handlers. It's not SQL, but we're using a template handler to make writing parameterized queries trivial for ArangoDB: https://github.com/arangodb/arangojs#aql https://github.com/arangodb/arangojs#aql
Example:
var userCollection = db.collection('_users');
var role = 'admin';
db.query(aql`
FOR user IN ${userCollection}
FILTER user.role == ${role}
RETURN user
`)
The template handler returns an object with the parameterized query string and the parameter values, which the `query` method understands. Because collection parameters are syntactically distinct from regular parameters this also avoids accidentally passing in arbitrary strings as collection names -- and of course it completely avoids injection attacks as a category.
In my experience this is actually much more comfortable to use than a "fluent" API that tries to map the query language to the programming language (i.e. `select('id').from('foo')` and so on).
Full disclosure: I wrote that library.