4 ms·

duckDB is what sql should be in 2024 https://duckdbsnippets.com/ https://duckdbsnippets.com/

• xigoi 2y ago
  The very first example on that page is vulnerable to injection.
  • richbell 2y ago
    Which one?
    • xigoi 2y ago
      #!/bin/bash function csv_to_parquet() { file_path="$1" duckdb -c "COPY (SELECT * FROM read_csv_auto('$file_path')) TO '${file_path%.*}.parquet' (FORMAT PARQUET);" }
      • richbell 2y ago
        Eh, in the context of the site and other snippets that seems pedantic. Could it be run on untrusted user input? Sure. Does it actually pose a threat? It's improbable.