4 ms·
honestly, use prepared statements... You get the same benefit of "template literals" but the data and query are separated at the DB level. The DB knows what is
by WrtCdEvrydy 6y ago
honestly, use prepared statements...
You get the same benefit of "template literals" but the data and query are separated at the DB level. The DB knows what is data and what is query therefore any attempt at escaping from SQL will be quashed there.
- byhemechi 6y agoThat's what the library does. It just uses tagged template literals[1] so that it "feels" like you're writing a template string, while really it's a prepared statement. [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...