4 ms·
But this looks like a sql injection awaiting to happen: (defn inc! [id] (kc/exec-raw (format "UPDATE articles SET count = count + 1 WHERE id = %s" id
by pinopinopino 7y ago
But this looks like a sql injection awaiting to happen:
(defn inc! [id]
(kc/exec-raw (format "UPDATE articles SET count = count + 1 WHERE id = %s" id)))
(From https://github.com/tbsschroeder/clojure-webshop-app/blob/master/src/metro/components/db/articles.clj#L27 https://github.com/tbsschroeder/clojure-webshop-app/blob/mas...)
You don't need format it seems: https://github.com/korma/Korma/blob/master/src/korma/core.clj#L518 https://github.com/korma/Korma/blob/master/src/korma/core.cl...
- hellofunk 7y agosanitizing SQL queries is just as simple in Clojure as in any other language (maybe more so), even if it wasn't done in this example.
- pinopinopino 7y agoIt looks like it is builtin even in the library he uses. So not sure why he chooses format.