5 ms·
I don’t understand at all what the difference is between the two functions.
by empath75 8y ago
I don’t understand at all what the difference is between the two functions.
- deleted 8y ago[deleted]
- borntyping 8y agoThe second function only accepts strings defined at compile time, meaning it can't be called with strings created at runtime (i.e. any string containing user input).
- empath75 8y agoSo what to you do if you need to make a sql call based on user input?
- gnud 8y agoUse parameters, of course. Using SQL parameters for untrusted input is the only sane way to avoid SQL injections.
- EugeneOZ 8y agojust add "to_owned()" and problem solved. This function doesn't protect nothing, it's a bullshit. I love Rust, but author is far from the theme he is trying to describe. And theme is dangerous enough.
- C4K3 8y agoto_owned() converts to a String, not to a &'static str. Those are not the same. You can't create a &'static str dynamically (though you can mutate one using unsafe.)
- EugeneOZ 8y agolol, so you call your SQL just with constants? "username" in his example just for one user forever? Still a bullshit.
- C4K3 8y agoNo, only the SQL statement has to be 'static. It's not bullshit.
- EugeneOZ 8y agoCan you provide real-world example please?
- Khoth 8y agoFrom TFA: let _rows = sql_query("SELECT * FROM users WHERE username=?", &[username]); The statement is static, but the [username] part is not, it's just a variable that can have whatever username you want.
- EugeneOZ 8y agoand I already told that this example has no meaning, it's just a bullshit - nobody will use it in real app. You want to fetch from db info about the only one user, who's name is a constant? Yeah, all apps do it every day.
- derkha 8y agoYou can convert a `String` into a `&'static str` using only safe stdlib functions via `Box::leak(s.into())`. This uses `unsafe` internally, of course... but so does almost any code.
- C4K3 8y agoAh cool, I hadn't heard about Box::leak until now. Coming to stable in 1.26 it seems.