3 ms·
> it makes it easy to just write SQL but at the same time makes it almost impossible to have mistakes like SQL injections While I think this is totally the wa
by girvo 5y ago
> it makes it easy to just write SQL but at the same time makes it almost impossible to have mistakes like SQL injections
While I think this is totally the way to go, it is kind of amusing that PHP's PDO system was the "right" way to go all along in some ways
- hn_throwaway_99 5y agoMeh, not really. Some of the biggest benefits from slonik are only possible because of Javascript's support for tagged template literals [1], e.g. you write a statement like sql`SELECT id FROM foo WHERE bar = ${barValue}` Tagged template literals make it feel like you're just doing string concatenation, but it's done in such a way where under the covers it's actually creating prepared statements, and it is literally impossible to have SQL injection bugs unless you deliberately go out of your way to make them. 1. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- girvo 5y agoThat is exactly what PDO’s prepared statements do. It’s not string concatenation, and it’s explicitly to prevent SQL injection? I must be misunderstanding I guess.