2 ms·
But you could do that already, could you not? Django does. Its just not really SQL anymore then. Someone else also pointed out that you could just do this with
by mrweasel 2y ago
But you could do that already, could you not? Django does. Its just not really SQL anymore then.
Someone else also pointed out that you could just do this with functions. It seems like a very fancy way of avoiding using (). I don't know, maybe show me how that would solve the issue of unsafe SQL and I'd be more easily convinced.
- hombre_fatal 2y agoBecause it turns into a parameterized SQL query. This already exists in the Javascript ecosystem: sql`select * from users where id = ${id}` Turns into: { query: 'select * from users where id = $1', values: [id] } So if you tried an injection like this: sql`select * from users ${'where id = 3'}` It turns into an invalid statement since "where id = 3" cannot exist as a parameterized value for the same reason this doesn't work: { query: 'select * from users $1', values: ['where id = 3'] } Where you go from here is to offer a query(statement) function that requires the use of the tag string so that you can't accidentally pass in a normal string-interpolated string. Examples: - slonik: https://github.com/gajus/slonik?tab=readme-ov-file#protecting-against-unsafe-value-interpolation https://github.com/gajus/slonik?tab=readme-ov-file#protectin... - postgres.js: https://github.com/porsager/postgres?tab=readme-ov-file#queries https://github.com/porsager/postgres?tab=readme-ov-file#quer...
- pauleveritt 2y agoI actually have a stuff based on tagged (https://pypi.org/project/tagged/ https://pypi.org/project/tagged/) and htm.py (https://github.com/jviide/htm.py https://github.com/jviide/htm.py) So from a web development perspective, I can likely answer, if it is germane.