Re:Write an SQL query builder in 150 lines of Python
by sumtechguy on Friday August 27, 2021 @09:56AM
(#28327851)
I propose that the issue is at the ODBC layer.
We have 2 modes of using that thing.
Tightly bound. Basically you have a bit of query string with question marks in it and you bind out your data points. Either for sending/recieving.
Loosely bound. Here is a totally composed string ready to go just run it. Also a good way to make SQL injection attacks.
Both involve string manipulation.
I think the issue is the ODBC interface does not really map to what SQL is and does. The column binding sort of does. But not table, not where, not having, not sort, etc. So we end up re-inventing something that pastes over that. Building a string to feed into an API that feeds that over the network to a string parser on the other side to decompose it again then runs it and goes back the other way in a similar manner.
We have 2 modes of using that thing.
Tightly bound. Basically you have a bit of query string with question marks in it and you bind out your data points. Either for sending/recieving.
Loosely bound. Here is a totally composed string ready to go just run it. Also a good way to make SQL injection attacks.
Both involve string manipulation.
I think the issue is the ODBC interface does not really map to what SQL is and does. The column binding sort of does. But not table, not where, not having, not sort, etc. So we end up re-inventing something that pastes over that. Building a string to feed into an API that feeds that over the network to a string parser on the other side to decompose it again then runs it and goes back the other way in a similar manner.