6 ms·
This title is horrible. I clicked through expecting something interesting with let's say PostgreSQL parameterized queries. This has nothing to do with parameter
by onphonenow 5y ago
This title is horrible. I clicked through expecting something interesting with let's say PostgreSQL parameterized queries. This has nothing to do with parameterized queries, this is some kind of standard SQL injection issue on an intermediate layer.
- progforlyfe 5y agoStill, I hope the author realizes the problem so they won't repeat such a mistake. The fact that such a package exists is a little odd to begin with...
- onphonenow 5y agoWhy not just use the engines parameterized query support if you are supporting the feature? They are probably missing out on many of the OTHER benefits of prepared statements. Easily 60%+ of queries can be prepared reducing overhead sometimes significantly.
- addandsubtract 5y agoAt least it helped me understand that "parameterized queries" are a database feature and not just a library abstraction.
- onphonenow 5y agoRight, benefits include performance gains. From HN: https://blog.soykaf.com/post/postgresql-elixir-troubles/ https://blog.soykaf.com/post/postgresql-elixir-troubles/ In addition to security.