3 ms·

The JEP makes it kind of clear: > trading off a small amount of convenience to gain a large amount of safety

• paulddraper 3y ago
  *large *small
  • bcrosby95 3y ago
    You can create json and sql string template processors that suffer from no injection problems. I'd call that a large improvement over, for example, Javascript. But I'm not familiar enough with the string template feature in the other languages to comment on their relative security.
    • 5e92cb50239222b 3y ago
      This is a solved problem in .NET, and C# only has one kind of string templating: FormattableString foo = $"select * from {table} where {column} = 42"; https://learn.microsoft.com/en-us/ef/core/querying/sql-queries#passing-parameters https://learn.microsoft.com/en-us/ef/core/querying/sql-queri...
      • kaba0 3y ago
        Not sure if C# can do that, but java’s implementation can return an arbitrary object based on the templates/parameters.
    • paulddraper 3y ago
      > You can create json and sql string template processors that suffer from no injection problems. I'd call that a large improvement over, for example, Javascript. Bad example. JavaScript literally has that (ever since ES6). [1] function sql(strings, ...args) { // ... } sql`SELECT * FROM user WHERE email = $1` [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...