3 ms·
No, it isn't... db.query method recieves the parameters separately from the string parts and will turn it into a parameterized query. You're confusing/conflati
by tracker1 4y ago
No, it isn't... db.query method recieves the parameters separately from the string parts and will turn it into a parameterized query. You're confusing/conflating db.query`...` with db.query(``);
https://www.javascript.christmas/2020/11 https://www.javascript.christmas/2020/11
- ryanbrunner 4y agoAh, sorry! I haven't used templates much and an interpolation inside a string triggered my "oh shit security problem" sense.
- tracker1 4y agoCan understand that... in general, have fought vigorously against ORMs (and DI/IoC tooling) in JavaScript, and use Dapper in C# with similar interfaces. The template methods have allowed for some really powerful adaptations. Mostly in Database/SQL, XML/HTML, and JSS interpreters.