4 ms·
It can be used for escaping values for example var query = sql`select * from user where id=${id}` Similar for html, preventing injection. You just need to imp
by naranha 8y ago
It can be used for escaping values for example
var query = sql`select * from user where id=${id}`
Similar for html, preventing injection. You just need to implement the corresponding functions.
For example https://github.com/felixfbecker/node-sql-template-strings https://github.com/felixfbecker/node-sql-template-strings
- rbrcurtis 8y agoI don't see how this is better than var query = sql(`select * from user where id=${id}`);
- naranha 8y agoYes that's something the author does not explain well. sql is not a normal function but a special template "handler" with fixed parameters.
- egeozcan 8y agoIn your example, you get the concatenated string. If you use the tags, you can access the parts.
- gramstrong 8y agoIt's just a tiny language feature, removing the parenthesis is not the point of the template literal. FWIW, I like the way it looks for styled-components: const NameTag = styled.div` font-size: 12pt; margin: 3px; `;
- basil-rash 8y agoIn this case the sql function can not escape the id. If you were to use a tagged template, it could.
- deleted 8y ago[deleted]