3 ms·
I’d assume their current safe function isn’t taking a string, and is taking some sort of prepared statement? So they could have it take either their prepared st
by mcintyre1994 2y ago
I’d assume their current safe function isn’t taking a string, and is taking some sort of prepared statement? So they could have it take either their prepared statement or a template, and deprecate their prepared statement.
If a library has functions taking a string and executing it as SQL they probably shouldn’t make that take a template instead, but I’d hope that’s a separate explicitly unsafe function already.
- crazygringo 2y agoFor sqlite3, it absolutely takes a regular string. If you want to substitute parameters, you put a '?' in the string for each one, and provide an additional (optional) tuple parameter with the variables. So no, there's no explicitly unsafe function. That's my point.
- mcintyre1994 2y agoGotcha. I’d guess they’d want to deprecate that function and create a new one that only accepts a template then, which is definitely annoying! I figured they’d already have more separation between prepared and raw strings which would make it easier.