4 ms·
How would you solve this problem? Parameterized queries are already a thing and ORMs are all the rage ;)
by sarciszewski 12y ago
How would you solve this problem?
Parameterized queries are already a thing and ORMs are all the rage ;)
- Pxtl 12y agoI prefer ORMs, but they're a lot of overhead to get set-up so I don't blame others for using strings where appropriate... and every parametrized query API I've ever used has been a tremendous PITA which is why people throw up their hands and say "screw it, I'll just escape the quotes!". And of course, the database API could provide a good method to do that but nobody ever does because it's impossible to do it securely (and that's definitely a fault in SQL).
- laumars 12y agoHave you used parameterized queries in Perl? It's the same DBI API and only about 3 or 4 additional lines. Plus you can easily abstract that away into a little helper function if you desired. I'm on my phone at the moment but I'd be happy to post some example code later if you want it?