10 ms·

Prepared Statements are great. Is there any way to force the programmer to use (only) them?

• singron 5y ago
  From the DB, no. E.g. you could always have `query("... a = ? and b = "+b, [a])`. From within a language, you somehow need to restrict how you build up the query. E.g. a query builder or ORM usually makes it hard to use anything besides parameters, but they usually have escape hatches (e.g. a where method that takes arbitrary sql strings). One trick you can do in Go is to create a type like `type sqlLiteral string`. The type is private, so other packages can't directly instantiate it, but a string literal will automatically coerce to it. Basically, you can't compute sqlLiteral from arbitrary expressions. It must be a single hardcoded string literal.
• nicoburns 5y ago
  No, because constants and column names are of course legitimate parts of SQL queries (even those using prepared statements), and because queries with no parameters are also legitimate.
• namibj 5y ago
  Code review and static analysis work great, by allowing obviously-safe dynamic SQL where static SQL is insufficient.