4 ms·
From the GitHub docs: $( colName ) is also unsafe in the sense that whatever colName is will be thrown out directly to SQL. However, $$( colName )
by lukaseder 13y ago
From the GitHub docs:
$( colName ) is also unsafe in the sense that whatever
colName is will be thrown out directly to SQL. However,
$$( colName ) is a bit safer because it removes double
quotes and wraps the identifier
Gotta love that :-) It's obviously safer, given the amount of $. What does $$$( colName ) do?
- batbomb 13y agohaha yeah. I'm not sold on that yet, it was a design decision I made so that I personally could do some crazy things with column names. The lack of safety would only come if you had a string that was somehow modifiable by a user and that was to be used as a column name. So the $$ just means make the name use ANSI quotes, instead of an unquoted identified (column name). The single $ lets users implement whatever they want for a column name, which is useful if you want to keep a tiny library and not worry about database specific features like functions, etc...
- lukaseder 13y agoYes, I agree, that is one way to solve this problem. Another would be to check if the column name matches [A-Za-z_][A-Za-z_0-9]* If not, then quote. Another reason to quote things is the madness around various SQL dialect's understanding of case-insensitivity. When quoted, case-sensitivity is enforced.