3 ms·

That makes no sense. What are you interpolating? Some variable. And you now have to audit that THAT VARIABLE is safe.

• nicoburns 3y ago
  > What are you interpolating? Some variable. Nope, I'm generally interpolating an inline expression consisting entirely of string literals.
  • boxed 3y ago
    > generally Does not inspire confidence.
    • nicoburns 3y ago
      In the rare case that you're interpolating a variable, you'd need to audit it in review. This is similar to carefully auditing the rare use cases of raw SQL expression when using an ORM.
• squeaky-clean 3y ago
  sortable_fields = ["name", "age", "gpa"] selected_filter = sortable_fields[form.filterIndex] if form.sortBy == "asc": query += "ORDER BY {} ASC" elif form.sortBy == "desc": query += "ORDER BY {} DESC" Doesn't have any opportunity for SQL injection unless you have rogue programmers able to change code running in prod.