3 ms·
Interestingly, func`123 ${abc}` is not syntactic sugar for func(`123 ${123}`) . The latter interpolates the values into the template and passes the final strin
by DecoPerson 8y ago
Interestingly, func`123 ${abc}` is not syntactic sugar for func(`123 ${123}`) .
The latter interpolates the values into the template and passes the final string to the function as a single argument.
The former acts as shown in the article, passing the string pieces as an array and the value pieces as additional arguments. This allows SQORN to prevent SQL injection while building queries. See first FAQ on https://sqorn.org/docs/faq.html https://sqorn.org/docs/faq.html
You can also do some interesting stuff with the special ".raw" property of the string array passed. See here https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#Raw_strings https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- femto113 8y agoWorth noting also that there's nothing magical about the backtick being adjacent to the function, you can have whitespace inbetween, e.g func `123 ${abc}` or even func `123 ${abc}` Coupled with the vagueness around ; I expect this will make for some awesomely obfuscated JavaScript in the coming years.
- femto113 8y agoEven more nonsense possible since the tag function doesn't have to return a string, it can return a function, meaning you could chain these, e.g. function tag2(string, ...keys) { console.log("tag2", string, ...keys); return function tag1(string, ...keys) { console.log("tag1", string, ...keys); return "tag1-return-value" } } console.log(tag2`input to tag2``input to tag1`); yields tag2 [ 'input to tag2' ] tag1 [ 'input to tag1' ] tag1-return-value
- mcv 8y agoIs that not a dangerous way to prevent SQL injection? What happens if someone calls it with parentheses? Will that throw an error or will it bypass the SQL injection prevention?