News for hackers. Stuff that matters.

A comment on DenoDB. Parent comment

Re:DenoDB by girvo on Friday June 18, 2021 @02:11AM (#27547813)
> it makes it easy to just write SQL but at the same time makes it almost impossible to have mistakes like SQL injections

While I think this is totally the way to go, it is kind of amusing that PHP's PDO system was the "right" way to go all along in some ways

[ Parent | on HN ]
Re:DenoDB by hn_throwaway_99 on Friday June 18, 2021 @01:56PM (#27552997)
Meh, not really. Some of the biggest benefits from slonik are only possible because of Javascript's support for tagged template literals [1], e.g. you write a statement like

  sql`SELECT id FROM foo WHERE bar = ${barValue}`
Tagged template literals make it feel like you're just doing string concatenation, but it's done in such a way where under the covers it's actually creating prepared statements, and it is literally impossible to have SQL injection bugs unless you deliberately go out of your way to make them.

1. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

[ Parent | on HN ]
Re:DenoDB by girvo on Saturday June 19, 2021 @07:19PM (#27565455)
That is exactly what PDO’s prepared statements do. It’s not string concatenation, and it’s explicitly to prevent SQL injection?

I must be misunderstanding I guess.

[ Parent | on HN ]