4 ms·

> Aren't there other benefits to server-side parameter binding besides just SQL-injection safety? For instance, using PG's extended protocol (binary) instead of

> Aren't there other benefits to server-side parameter binding besides just SQL-injection safety? For instance, using PG's extended protocol (binary) instead of just raw SQL strings. Caching parameterized prepared statements, etc. All of which can be implemented on top of template strings. > A single character difference and now you've just made yourself trivially injectible. It's not just a one character difference, it's a different type. So `db.execute` can reject strings both statically and dynamically. > I don't think Definitely true. > this new format specifier is in any way applicable to SQL queries. It's literally one of PEP 750's motivations.

VWWHFSfQ 2y ago
> It's literally one of PEP 750's motivations. Python is notorious for misguided motivations. We're not "appealing to authority" here. We're free to point out when things are goofy.
willcipriano 2y ago
from string.templatelib import Template def execute(query: Template) Should allow for static analysis to prevent this issue if you run mypy as part of your pr process. That would be in addition to doing any runtime checks.
- benwilber0 2y ago
  The first mistake we're going to see a library developer make is: def execute(query: Union[str, Template]): Maybe because they want their execute function to be backwards compatible, or just because they really do want to allow either raw strings are a template string.
  - masklinn 2y ago
    > they really do want to allow either raw strings are a template string. I’d consider that an invalid use case: 1. You can create a template string without placeholders. 2. Even if the caller does need to pass in a string (because they’re executing from a file, or t-strings don’t support e.g. facetting) then they can just… wrap the string in a template explicitly.
woodrowbarlow 2y ago
nitpicking: > It's not just a one character difference, it's a different type. So `db.execute` can reject strings both statically and dynamically. in this case, that's not actually helpful because SQL statements don't need to have parameters, so db.execute will always need to accept a string.
- anamexis 2y ago
  You can just pass it a template with no substitutions.
- masklinn 2y ago
  > db.execute will always need to accept a string. No. A t-string with no placeholders is perfectly fine. You can use that even if you have no parameters.
tczMUFlmoNk 2y ago
> > I don't think > Definitely true. The rest of your comment is valuable, but this is just mean-spirited and unnecessary.
rangerelf 2y ago
>> I don't think >Definitely true. I thought we left middle-school playground tactics behind.
davepeck 2y ago
> Caching parameterized prepared statements, etc. I didn’t explicitly mention this in my post but, yes, the Template type is designed with caching in mind. In particular, the .strings tuple is likely to be useful as a cache key in many cases.
deleted 2y ago
[deleted]

VWWHFSfQ 2y ago

> It's literally one of PEP 750's motivations. Python is notorious for misguided motivations. We're not "appealing to authority" here. We're free to point out when things are goofy.

willcipriano 2y ago

from string.templatelib import Template def execute(query: Template) Should allow for static analysis to prevent this issue if you run mypy as part of your pr process. That would be in addition to doing any runtime checks.

benwilber0 2y ago
The first mistake we're going to see a library developer make is: def execute(query: Union[str, Template]): Maybe because they want their execute function to be backwards compatible, or just because they really do want to allow either raw strings are a template string.
- masklinn 2y ago
  > they really do want to allow either raw strings are a template string. I’d consider that an invalid use case: 1. You can create a template string without placeholders. 2. Even if the caller does need to pass in a string (because they’re executing from a file, or t-strings don’t support e.g. facetting) then they can just… wrap the string in a template explicitly.

woodrowbarlow 2y ago

nitpicking: > It's not just a one character difference, it's a different type. So `db.execute` can reject strings both statically and dynamically. in this case, that's not actually helpful because SQL statements don't need to have parameters, so db.execute will always need to accept a string.

anamexis 2y ago
You can just pass it a template with no substitutions.
masklinn 2y ago
> db.execute will always need to accept a string. No. A t-string with no placeholders is perfectly fine. You can use that even if you have no parameters.

tczMUFlmoNk 2y ago

> > I don't think > Definitely true. The rest of your comment is valuable, but this is just mean-spirited and unnecessary.

rangerelf 2y ago

>> I don't think >Definitely true. I thought we left middle-school playground tactics behind.

davepeck 2y ago

> Caching parameterized prepared statements, etc. I didn’t explicitly mention this in my post but, yes, the Template type is designed with caching in mind. In particular, the .strings tuple is likely to be useful as a cache key in many cases.

deleted 2y ago

[deleted]