3 ms·
You don't need format strings to create vulnerable queries. If you can't use them, this code: let query = format!("SELECT name FROM users WHERE id = {}", u
by adwn 5y ago
You don't need format strings to create vulnerable queries. If you can't use them, this code:
let query = format!("SELECT name FROM users WHERE id = {}", user_id);
can easily be replaced by this:
let mut query = String::from("SELECT name FROM users WHERE id = ");
query += user_id;
What, are you also going to forbid simple string operations? There will be some user that will use them to create an unsanitized query.
- gspr 5y ago> You don't need format strings to create vulnerable queries. If you can't use them, this code: I know, thank you. > What, are you also going to forbid simple string operations? Dude, chill. Why do you feel attacked? I'm just stating facts. Those facts are not a critique of you (or of Rust, a language I love).
- adwn 5y agoI'm not feeling "attacked". I'm trying to help you understand that the argument "feature X might be used in a way that could lead to a incorrect behavior" on its own isn't enough to warrant exclusion of that feature, because that same argument can be used against basically all features of a language.