3 ms·
In most environments, it’s more effort to interpolate values into queries than to use parameters.
by dontlaugh 3y ago
In most environments, it’s more effort to interpolate values into queries than to use parameters.
- silon42 3y agoHuh, no? Tt's very easy to do it incorrectly. It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).
- throwaway894345 3y agoDon't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).
- magicalhippo 3y agoNot only more effort, but also the only way in certain cases as not everything supports parameterization. The IN operator for example is one where we fall back to string interpolation, though not directly with user values.