3 ms·
Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different
by mootothemax 10y ago
Totally, you can have some safety via, err, type safety. In the links I posted though (which I now realise match enough files that everyone must see a different results page), I was seeing a tonne of string concatenation on e.g. username fields.
The interesting bit for me is that despite pretty much well every C# SQL example out there using parameterised queries, people still find a way to come up with their own broken alternatives.
- merb 10y agoThats true, actually I mostly code in Scala and there are many SQL libraries that allow you to do: sql"""SELECT * FROM users WHERE username = $username""" Actually that looks like a problem at first, however the library will actually create a parameterised query out of it. It's pretty cool since now you don't need to think about (http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpolation http://slick.lightbend.com/doc/3.1.1/sql.html#string-interpo... or https://github.com/playframework/anorm/blob/master/docs/manual/working/scalaGuide/main/sql/ScalaAnorm.md#sql-queries-using-string-interpolation https://github.com/playframework/anorm/blob/master/docs/manu...)