4 ms·
Uhhhh, you should be extremely careful with string interpolation around DB statements. The code sample you posted is pretty much a textbook case of a SQL inject
by ryanbrunner 4y ago
Uhhhh, you should be extremely careful with string interpolation around DB statements. The code sample you posted is pretty much a textbook case of a SQL injection vulnerability if the value of ${baz} is ever provided by a user.
- tracker1 4y agoNo, it isn't... db.query method recieves the parameters separately from the string parts and will turn it into a parameterized query. You're confusing/conflating db.query`...` with db.query(``); https://www.javascript.christmas/2020/11 https://www.javascript.christmas/2020/11
- ryanbrunner 4y agoAh, sorry! I haven't used templates much and an interpolation inside a string triggered my "oh shit security problem" sense.
- tracker1 4y agoCan understand that... in general, have fought vigorously against ORMs (and DI/IoC tooling) in JavaScript, and use Dapper in C# with similar interfaces. The template methods have allowed for some really powerful adaptations. Mostly in Database/SQL, XML/HTML, and JSS interpreters.