News for hackers. Stuff that matters.
Re:DenoDB by hn_throwaway_99 on Friday June 18, 2021 @01:56PM (#27552997)
Meh, not really. Some of the biggest benefits from slonik are only possible because of Javascript's support for tagged template literals [1], e.g. you write a statement like

  sql`SELECT id FROM foo WHERE bar = ${barValue}`
Tagged template literals make it feel like you're just doing string concatenation, but it's done in such a way where under the covers it's actually creating prepared statements, and it is literally impossible to have SQL injection bugs unless you deliberately go out of your way to make them.

1. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

Re:DenoDB by girvo on Saturday June 19, 2021 @07:19PM (#27565455)
That is exactly what PDO’s prepared statements do. It’s not string concatenation, and it’s explicitly to prevent SQL injection?

I must be misunderstanding I guess.