4 ms·
Imagine the question is something like "How do I concatenate these strings into an SQL query?" Would you be willing to be responsible for the fallout of answer
by shawnz 5y ago
Imagine the question is something like "How do I concatenate these strings into an SQL query?"
Would you be willing to be responsible for the fallout of answering that question any other way besides "use parameterized queries instead"? Do you really think that should only be mentioned as a passing reference?
- unionpivo 5y agoExcept that you sometimes have to anyway (not for parameters, but to have dynamic conditions, filters etc.) And since every question about such things get auto corrected to use parameters (which doesn't help, since it's something else entirely), You have millions of buggy self glued sql queries allover code bases. (but hey most of them are using parameters, so yay - progress)
- shawnz 5y agoIn those cases the best solution would be to use a query builder library like JOOQ, I still wouldn't be willing to recommend someone in that position builds the query by concatenating strings together
- ballenf 5y agoAbsolutely, yes. Someone has to write the parameterization libraries. That is, whatever abstraction layer you want to employ, in the end SQL queries are strings. And the passing reference to the potential misuse here can be a big bold statement at the top of your answer.