5 ms·
You could try to create some sort of SQL-builder API where each fragment must be static, and each fragment contains its own placeholders. Then you can use cond
by gnud 8y ago
You could try to create some sort of SQL-builder API where each fragment must be static, and each fragment contains its own placeholders.
Then you can use conditionals and loops to decide which fragments are included.
- pc86 8y agoOr you can just use runtime SQL injection prevention methods?
- coldtea 8y agoOr just have an employee carefully monitor user input manually, and have them propagate it to the backend with a delay. That is, sure, it's not like Rust takes the option to check for injection at runtime.
- jcelerier 8y agoWhy "just" ? It's incredibly more costly than having the injections being prevented at compile-time.
- ufo 8y agoI think the appeal of sql builder apis is that they make it much harder to shoot yourself in the foot. If your queries are strings you can use placeholder syntax to avoid injection but all there is nothing stopping you (or a junior dev) from writing something stupid like "and name ='" + username + "'". If queries are represented with a separate datatype then it is much harder to put unsanitized user input strings inside them.