4 ms·
Some SQL engines support accepting parameters separately so that values get bound to the query once the abstract syntax tree is already built, which is way safe
by NewEntryHN 1y ago
Some SQL engines support accepting parameters separately so that values get bound to the query once the abstract syntax tree is already built, which is way safer than string escapes shenanigans.
- ljm 1y agoI’d always prefer to use a prepared statement if I can, but sadly that’s also less feasible in the fancy new serverless execution environments where the DB adapter often can’t support them. For me it just makes it easier to identify as safe, because it might not be obvious at a glance that an interpolated template string is properly sanitised.