6 ms·

I don't see what it adds over f-string in that example?

• teruakohatu 1y ago
  If I pass an f-string to a method, it just sees a string. If I pass a t-string the method can decide how to process the t-string.
• evertedsphere 1y ago
  safety against sql injection
• ds_ 1y ago
  The execute function can recognize it as a t-string and prevent SQL injection if the name is coming from user input. f-strings immediately evaluate to a string, whereas t-strings evaluate to a template object which requires further processing to turn it into a string.
  • Tenoke 1y ago
    Then the useful part is the extra execute function you have to write (it's not just a substitute like in the comment) and an extra function can confirm the safety of a value going into a f-string just as well. I get the general case, but even then it seems like an implicit anti-pattern over doing db.execute(f"QUERY WHERE name = {safe(name)}")
    • ubercore 1y ago
      Problem with that example is where do you get `safe`? Passing a template into `db.execute` lets the `db` instance handle safety specifically for the backend it's connected to. Otherwise, you'd need to create a `safe` function with a db connection to properly sanitize a string. And further, if `safe` just returns a string, you still lose out on the ability for `db.execute` to pass the parameter a different way -- you've lost the information that a variable is being interpolated into the string.
      • Tenoke 1y ago
        db.safe same as the new db.execute with safety checks in it you create for the t-string but yes I can see some benefits (though I'm still not a fan for my own codebases so far) with using the values further or more complex cases than this.
        • ubercore 1y ago
          Yeah but it would have to be something like `db.safe("SELECT * FROM table WHERE id = {}", row_id)` instead of `db.execute(t"SELECT * FROM table WHERE id = {row_id}")`. I'd prefer the second, myself.
          • Tenoke 1y ago
            No, just `db.execute(f"QUERY WHERE name = {db.safe(name)}")` And you add the safety inside db.safe explicitly instead of implicitly in db.execute. If you want to be fancy you can also assign name to db.foos inside db.safe to use it later (even in execute).
            • ZiiS 1y ago
              But if someone omits the `safe` it may still work but allow injection.
              • thunky 1y ago
                Same is true if someone forgets to use t" and uses f" instead. At least db.safe says what it does, unlike t".
                • ewidar 1y ago
                  Not really, since f"" is a string and t"" is a template, you could make `db.execute` only accept templates, maybe have `db.execute(Template)` and `db.unsafeExecute(str)`
    • NewEntryHN 1y ago
      Some SQL engines support accepting parameters separately so that values get bound to the query once the abstract syntax tree is already built, which is way safer than string escapes shenanigans.
      • ljm 1y ago
        I’d always prefer to use a prepared statement if I can, but sadly that’s also less feasible in the fancy new serverless execution environments where the DB adapter often can’t support them. For me it just makes it easier to identify as safe, because it might not be obvious at a glance that an interpolated template string is properly sanitised.
    • Mawr 1y ago
      But you have to remember to call the right safe() function every time: db.execute(f"QUERY WHERE name = {name}") db.execute(f"QUERY WHERE name = {safe_html(name)}") Oops, you're screwed and there is nothing that can detect that. No such issue with a t-string, it cannot be misused.
    • dragonwriter 1y ago
      > and an extra function can confirm the safety of a value going into a f-string just as well. Yes, you could require consumers to explicitly sanitize each parameter before it goes into the f-string, or, because it has the structure of what is fixed and what is parameters, it can do all of that for all parameters when it gets a t-string. The latter is far more reliable, and you can't do it with an f-string because an f-string after creation is just a static string with no information about construction.
    • zahlman 1y ago
      > Then the useful part is the extra execute function you have to write Well, no, the library author writes it. And the library author also gets to detect whether you pass a Template instance as expected, or (erroneously) a string created by whatever formatting method you choose. Having to use `safe(name)` within the f-string loses type information, and risks a greater variety of errors.
• burky 1y ago
  f-strings won’t sanitize the value, so it’s not safe. The article talks about this.
  • Tenoke 1y ago
    The article talked about it but the example here just assumes they'll be there.
    • sanderjd 1y ago
      What do you mean by "they"? You mean the template interpolation functions? Yes, the idea is that by having this in the language, library authors will write these implementations for use cases where they are appropriate.
      • Tenoke 1y ago
        The sanitization. Just using a t-string in your old db.execute doesn't imply anything safer is going on than before.
        • masklinn 1y ago
          Using a t-string in a db.execute which is not compatible with t-strings will result in an error. Using a t-string in a db-execute which is, should be as safe as using external parameters. And using a non-t-string in that context should (eventually) be rejected.
          • Tenoke 1y ago
            Again, just because a function accepts a t string it doesn't mean there's sanitization going on by default.
            • tikhonj 1y ago
              Yes, but if a function accepts a template (which is a different type of object from a string!), either it is doing sanitization, or it explicitly implemented template support without doing sanitization—hard to do by accident! The key point here is that a "t-string" isn't a string at all, it's a new kind of literal that's reusing string syntax to create Template objects. That's what makes this new feature fundamentally different from f-strings. Since it's a new type of object, libraries that accept strings will either have to handle it explicitly or raise a TypeError at runtime.
• sureglymop 1y ago
  Wouldn't this precisely lead to sql injection vulnerabilities with f-strings here?
• sim7c00 1y ago
  it makes it so people too lazy to make good types and class will be getting closer to sane code without doing sane code... imagine writing a SqL where u put user input into query string directly. now remember its 2025, lie down try not to cry.