3 ms·

> but sanitization is completely ignored in the post, and should at least be mentioned Why do you need a sanitization for bind parameters?

• cookiengineer 2y ago
  Because type correctness does not imply branch correctness. SQL has side effects of interpretation, and any string/query builder that is not aware of grammatical implications should be avoided in my opinion. Check the query builder of sqlx [1] [1] https://github.com/launchbadge/sqlx/blob/main/sqlx-core/src/query_builder.rs https://github.com/launchbadge/sqlx/blob/main/sqlx-core/src/...
  • bvrmn 2y ago
    I clearly don't understand something about implications. Could you please elaborate or give a link to read about it? What is branch correctness? How could it be exploited? How does sanitization prevent it? sqlx looks like a usual builder, I don't see nothing criminal about it.
  • c00kien1gg3r 2y ago
    [dead]