4 ms·
(author here) Yup, good thing to note, thank you! I've kinda assumed everyone knows about the named parameters some bindings offer, but that's probably not tr
by genericlemon24 5y ago
(author here)
Yup, good thing to note, thank you!
I've kinda assumed everyone knows about the named parameters some bindings offer, but that's probably not true. Will add a disclaimer.
In the previous articles, I do talk about how this is an upgrade from plain SQL, not from regular full-blown query builders / ORMs.
- quietbritishjim 5y ago> I do talk about how this is an upgrade from plain SQL This statement is about functionality / ease of use, which is fairly orthogonal from (preventing) SQL injection: with plain SQL it's perfectly possible to avoid injection attacks, in fact that's probably the most common and easiest way to do it. In that sense, if anything this is a downgrade from regular SQL.
- genericlemon24 5y ago> In that sense, if anything this is a downgrade from regular SQL. It likely is. Ideally, instead of dynamically building queries, one would use stored procedures. I'm using this with SQLite, which doesn't have stored procedures, so it's an acceptable downgrade for me. Appending strings to lists gets messy quickly, example: https://death.andgravity.com/query-builder-why#preventing-combinatorial-explosion https://death.andgravity.com/query-builder-why#preventing-co...
- em500 5y agoDefinitely not true, I've encountered plenty of SQL users at work who never heard of injection attacks or parameterized queries. Some of them even built some ad-hoc query builders to replace some of their own repetitive queries. (Note that parameterized queries alone are not sufficient: often people would try to parameterize table or column names.)