2 ms·
I prefer ORMs, but they're a lot of overhead to get set-up so I don't blame others for using strings where appropriate... and every parametrized query API I've
by Pxtl 12y ago
I prefer ORMs, but they're a lot of overhead to get set-up so I don't blame others for using strings where appropriate... and every parametrized query API I've ever used has been a tremendous PITA which is why people throw up their hands and say "screw it, I'll just escape the quotes!". And of course, the database API could provide a good method to do that but nobody ever does because it's impossible to do it securely (and that's definitely a fault in SQL).
- laumars 12y agoHave you used parameterized queries in Perl? It's the same DBI API and only about 3 or 4 additional lines. Plus you can easily abstract that away into a little helper function if you desired. I'm on my phone at the moment but I'd be happy to post some example code later if you want it?