4 ms·
>template based There's a reason why the modern approach is parameterized: The old PHP-style templating led to galore SQL injections, and worse performance. Do
by yyyk 4y ago
>template based
There's a reason why the modern approach is parameterized: The old PHP-style templating led to galore SQL injections, and worse performance. Don't see any reason to ever go back.
- mirekrusin 4y agoThis is common misunderstanding. Tagged templates in js allow you to write safe, injection free sql templates, tsql does exactly that. Performance is better if anything, but irrelevant - you're talking about sql rendering performance, which is several orders of magnitude lower than invoking query? You should double check it. See examples of usage. We use it for mssql but same principles apply to other vendors. Mssql has many interesting things in its dialect that can't be expressed in orm. With templates you simply write sql and aid yourself with functional combinators for complex statements. It works really well.
- yyyk 4y agoI'm referring to possible performance loss due to lack of parameterization. Yeah, one could enable forced parameterization and let parameter sniffing do its job, but that can be a double edged sword.