4 ms·
I don’t think I’m even in favor of automatic string escaping; string escaping generally is a ridiculous concept, for any place where we’re not intentionally mix
by setr 4y ago
I don’t think I’m even in favor of automatic string escaping; string escaping generally is a ridiculous concept, for any place where we’re not intentionally mixing code & data e.g. a user-supplied regex — if it’s a user-supplied string that we intend to stuff into the middle of a regex as simple text… we should be capable of simply saying that’s what we want to do. Instead of smearing backslashes everywhere.
Keep the inputs out-of-band and this whole problem doesn’t even exist as a concept
- jeltz 4y agoWhich is what the PostgreSQL protocol does. It supports sending the query and its parameters separately. HTML on the other hand does not support that.