3 ms·
Exactly. I'm happy with tsql [0] - template based, with safe sanitation, helper renderers/combinators, used in production for several years, would recommend thi
by mirekrusin 4y ago
Exactly. I'm happy with tsql [0] - template based, with safe sanitation, helper renderers/combinators, used in production for several years, would recommend this approach. It's basically pure sql with safe helpers when you want to use them. You can't use orm if you want to use underlying database beyond common denominator for basics.
[0] https://github.com/appliedblockchain/tsql https://github.com/appliedblockchain/tsql
- yyyk 4y ago>template based There's a reason why the modern approach is parameterized: The old PHP-style templating led to galore SQL injections, and worse performance. Don't see any reason to ever go back.
- mirekrusin 4y agoThis is common misunderstanding. Tagged templates in js allow you to write safe, injection free sql templates, tsql does exactly that. Performance is better if anything, but irrelevant - you're talking about sql rendering performance, which is several orders of magnitude lower than invoking query? You should double check it. See examples of usage. We use it for mssql but same principles apply to other vendors. Mssql has many interesting things in its dialect that can't be expressed in orm. With templates you simply write sql and aid yourself with functional combinators for complex statements. It works really well.
- yyyk 4y agoI'm referring to possible performance loss due to lack of parameterization. Yeah, one could enable forced parameterization and let parameter sniffing do its job, but that can be a double edged sword.