4 ms·
They've looked at Postgres.js (https://github.com/porsager/postgres https://github.com/porsager/postgres) before — wouldn't mind if they enabled those other cas
by porsager 3y ago
They've looked at Postgres.js (https://github.com/porsager/postgres https://github.com/porsager/postgres) before — wouldn't mind if they enabled those other cases in the same way.
Also, node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...
- jmull 3y ago> node-postgres is ripe for sql injections because you just concatenate strings yourself when using it... Why the heck would you do that? I guess for any library that accepts SQL, someone might concatenate strings rather than use the parameter handling.
- heatmiser 3y agoThe things I've seen because people don't want to learn an ORM's (or similar tech) API.
- jmull 3y agoI mean that node-posgres doesn't encourage anyone to include parameter values through string concatenation, at least no more than porsager or other SQL-based clients. Not sure what ORMs have to do with it. They do include a safe parameter substitution mechanism, but so do typical SQL-based clients.
- porsager 3y agoIt doesn't explicitly encourage you to do it, but it's very much right there - waiting to happen because you always just pass a string to the query function? In Postgres.js you have to use a function that is specifically named `unsafe` to do that.
- wereHamster 3y agoThe examples on https://node-postgres.com/features/queries https://node-postgres.com/features/queries clearly show how to use parametrized queries. Of course you /can/ concatenate strings, no library in the JS land will prevent you from doing that. But the examples are pretty clear how to do it correctly.
- porsager 3y agoWell that's exactly what Postgres.js will do for you ;)