3 ms·
Always prescribing raw sql is dangerous: You typically want something managing your sql queries if there's user input because scrubbing out SQL injections is ha
by dnautics 6y ago
Always prescribing raw sql is dangerous: You typically want something managing your sql queries if there's user input because scrubbing out SQL injections is hard and it's not something you should be 'rolling your own'
- skrtskrt 6y agoYes, I'm really talking about using libraries that let you pass parameters into a statement, and have some level of protection against injection.
- dnautics 6y agoI was just reacting to this, which is confusing given your response. > In Go I just write the raw SQL. But in general I agree with you about ORMs (I do not use them). I'm just pointing out that when the easiest/most popular library to reach for to protect yourself against injection is an ORM, it's understandable to use it.
- winstonewert 6y agoI presume that when somebody says raw sql they mean are using parameters and not just building strings.
- tempodox 6y agoYou should use ODBC or one of its siblings anyway. Never use printf() or raw string concatenation for SQL queries yourself.