5 ms·

If you're building SQL with string concatenation of data, you've lost. You're not secure. Give up. Parameterised queries are straightforward in all competent l

If you're building SQL with string concatenation of data, you've lost. You're not secure. Give up. Parameterised queries are straightforward in all competent languages. If Python can't do it natively, switch to a better language that can.

collyw 7y ago
Where did I say I was concatenating data? You might want to take a look at Django's ORM before making comments like that, it handles parametrised queries fine.
- sjwright 7y ago
  The way I see it, an ORM is just a way of formalising the false assumption that a database is stupid and useless. I've taken a look at a couple of Django's most popular ORM options and I suppose if I was a mid-level corporate cog writing CRUD interfaces for Stack Overflow tutorial-grade operations like customer-sale-item-product relationships it would probably work fine. I've only had passing exposure to that kind of soul-crushing drudge work. For the way I work an ORM is baby stuff, and I'm not even doing anything particularly advanced or sophisticated. I maintain (among other things) a relatively unremarkable bespoke online discussion forum. It comprises hundreds of queries, few of which could be composed correctly by an ORM, let alone composed and run performantly. The median complexity query in my code base probably has two or three joins and two or three subqueries—at least one of which has some kind of tangential aggregation or window function.
  - collyw 7y ago
    > For the way I work an ORM is baby stuff https://www.reddit.com/r/iamverysmart/ https://www.reddit.com/r/iamverysmart/ > a relatively unremarkable bespoke online discussion forum. >It comprises has hundreds of queries Sounds like you have a design issue. Making the unremarkable complex.
    - sjwright 7y ago
      Thanks for the well deserved lesson in internet arguments. You win, sir. (For the record, complexity and remarkability aren't strong correlates. And it's not particularly complex; probably 90% of the app's queries are written for indirect tasks like moderation tools, automations, statistical reports and various stratum of anti-abuse mechanisms. Most common pages only have one security-related query and one content-related query.)

collyw 7y ago

Where did I say I was concatenating data? You might want to take a look at Django's ORM before making comments like that, it handles parametrised queries fine.

sjwright 7y ago
The way I see it, an ORM is just a way of formalising the false assumption that a database is stupid and useless. I've taken a look at a couple of Django's most popular ORM options and I suppose if I was a mid-level corporate cog writing CRUD interfaces for Stack Overflow tutorial-grade operations like customer-sale-item-product relationships it would probably work fine. I've only had passing exposure to that kind of soul-crushing drudge work. For the way I work an ORM is baby stuff, and I'm not even doing anything particularly advanced or sophisticated. I maintain (among other things) a relatively unremarkable bespoke online discussion forum. It comprises hundreds of queries, few of which could be composed correctly by an ORM, let alone composed and run performantly. The median complexity query in my code base probably has two or three joins and two or three subqueries—at least one of which has some kind of tangential aggregation or window function.
- collyw 7y ago
  > For the way I work an ORM is baby stuff https://www.reddit.com/r/iamverysmart/ https://www.reddit.com/r/iamverysmart/ > a relatively unremarkable bespoke online discussion forum. >It comprises has hundreds of queries Sounds like you have a design issue. Making the unremarkable complex.
  - sjwright 7y ago
    Thanks for the well deserved lesson in internet arguments. You win, sir. (For the record, complexity and remarkability aren't strong correlates. And it's not particularly complex; probably 90% of the app's queries are written for indirect tasks like moderation tools, automations, statistical reports and various stratum of anti-abuse mechanisms. Most common pages only have one security-related query and one content-related query.)