3 ms·
Yes I remember inheriting a project where in a similar fashion people were allergic to join. So we got js code selecting entire table, looping over the rows an
by darepublic 4y ago
Yes I remember inheriting a project where in a similar fashion people were allergic to join. So we got js code selecting entire table, looping over the rows and then doing inner loops with further selects. I eventually had to switch everything around to using joins. There seemed to be a huge disdain for SQL.. like if you ever endeavoured to try some raw SQL you were playing with matches. Sure OK but code that is handling db operations that inefficiently is 100x worse tho...
- tracker1 4y agoI tend to push for the other direction, especially if using JS/TS... template literals are so useful here... const foo: MyType[] = await db.query` SELECT ... FROM ... WHERE bar = ${baz} `; And simply understanding how the queries work... very similar with Dapper in C#... I'm kind of all out against ORMs at this point.
- ryanbrunner 4y agoUhhhh, you should be extremely careful with string interpolation around DB statements. The code sample you posted is pretty much a textbook case of a SQL injection vulnerability if the value of ${baz} is ever provided by a user.
- tracker1 4y agoNo, it isn't... db.query method recieves the parameters separately from the string parts and will turn it into a parameterized query. You're confusing/conflating db.query`...` with db.query(``); https://www.javascript.christmas/2020/11 https://www.javascript.christmas/2020/11
- ryanbrunner 4y agoAh, sorry! I haven't used templates much and an interpolation inside a string triggered my "oh shit security problem" sense.
- tracker1 4y agoCan understand that... in general, have fought vigorously against ORMs (and DI/IoC tooling) in JavaScript, and use Dapper in C# with similar interfaces. The template methods have allowed for some really powerful adaptations. Mostly in Database/SQL, XML/HTML, and JSS interpreters.