4 ms·

Not really, since f"" is a string and t"" is a template, you could make `db.execute` only accept templates, maybe have `db.execute(Template)` and `db.unsafeExe

• thunky 1y ago
  agreed. but then you're breaking the existing `db.execute(str)`. if you don't do that, and instead add `db.safe_execute(tpl: Template)`, then you're back to the risk that a user can forget to call the safe function. also, you're trusting that the library implementer raises a runtime exception if a string a passed where a template is expected. it's not enough to rely on type-checks/linting. and there is probably going to be a temptation to accept `db.execute(sql: Union[str, Template])` because this is non-breaking, and sql without params doesn't need to be templated - so it's breaking some stuff that doesn't need to be broken. i'm not saying templates aren't a good step forward, just that they're also susceptible to the same problems we have now if not used correctly.
  • ubercore 1y ago
    Then make `db.unsafe_execute` take a string.
    • thunky 1y ago
      Yeah, you could. I'm just saying that by doing this you're breaking `db.execute` by not allowing it to take it string like it does now. Libraries may not want to add a breaking change for this.