There is a common denominator between shelling out and making SQL queries: using strings to construct executable code. Metaprogramming with strings and eval, e.

There is a common denominator between shelling out and making SQL queries: using strings to construct executable code. Metaprogramming with strings and eval, e.g. in Perl/Python/Ruby, is another place where this is done – and is fraught with similar issues. Lisp has metaprogramming, yet doesn't have this problem. Why? Because you don't do unstructured metaprogramming with strings in Lisp. Instead you do structured metaprogramming using lists and symbols. Julia also has structured metaprogramming [1]. For running external commands, Julia gives you a structured metaprogramming solution: the `cmd` form is really a list construct in disguise – one that understands shell syntax and is therefore easy and intuitive to use. The same approach can and probably should be used to make SQL query construction both convenient and safe. [1] http://julia.readthedocs.org/en/latest/manual/metaprogramming/ http://julia.readthedocs.org/en/latest/manual/metaprogrammin...