4 ms·
> every sane sql client library supports some form of prepared statements out of the box this is true > they are really simple to use this is not. The amoun
by Pxtl 7y ago
> every sane sql client library supports some form of prepared statements out of the box
this is true
> they are really simple to use
this is not. The amount of boilerplate I've written to properly parameterize a common pattern like
SELECT * FROM FOO WHERE
FOO.SomeKey IN (/* user-provided list of chosen values goes here */)
is grotesque.
- pdkl95 7y agoI'm not sure I would classify a sql client library that doesn't support arrays as "sane". This may have been annoying in the past, I would expect modern libraries to handle basic features like 'IN" automagically. list = ['bar', 'baz', "Robert'); DROP TABLE Students;--"] Foo.where(name: list) # Foo Load (0.3ms) # SELECT "foo".* FROM "foo" # WHERE "foo"."name" IN (?, ?, ?) # [["name", "bar"], # ["name", "baz"], # ["name", "Robert'); DROP TABLE Students;--"]]