3 ms·
some parts of a query cannot be parameterized, e.g. the column name for an 'order by' in many cases. So you have to do some kind of escaping, sanitation and con
by corty 6y ago
some parts of a query cannot be parameterized, e.g. the column name for an 'order by' in many cases. So you have to do some kind of escaping, sanitation and concatenation.
- tester756 6y agoWhile this solution isn't sexy, cannot it be just simple switch? switch(int) case 1: age case 2: salary
- namibj 6y agoI have yet to dream up/see a case where you can't puzzle literals together based on user-query parsing until you get your SQL query assembled.
- corty 6y agoYes, unless the database has custom column names e.g. to add your own properties to some object. But that kind of schema is madness in other aspects as well...
- namibj 6y agoIf you're escaping/sanitizing to massage an input string until you can concatenate it into a SQL query, you're doing it wrong. Please don't.