Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on How can you be fooled by the U+202E trick? (2013). Parent comment
Yes, this aspect of SQL is poorly conceived because the only way is to manipulate it with text processing.
Parameters should be inserted into a query language using AST manipulation, like a Lisp backquote.
Now within a particular program, we can wrap something like that around SQL generation, and solve the escaping problems in one place.
That approach doesn't apply to character data, which has to be literal and primitive in many situations.
There are no comments on this comment yet.
Yes, this aspect of SQL is poorly conceived because the only way is to manipulate it with text processing.
Parameters should be inserted into a query language using AST manipulation, like a Lisp backquote.
Now within a particular program, we can wrap something like that around SQL generation, and solve the escaping problems in one place.
That approach doesn't apply to character data, which has to be literal and primitive in many situations.