duckDB is what sql should be in 2024
The very first example on that page is vulnerable to injection.
Which one?
#!/bin/bash
function csv_to_parquet() {
file_path="$1"
duckdb -c "COPY (SELECT * FROM read_csv_auto('$file_path')) TO '${file_path%.*}.parquet' (FORMAT PARQUET);" }Eh, in the context of the site and other snippets that seems pedantic.
Could it be run on untrusted user input? Sure. Does it actually pose a threat? It's improbable.
Duckdb also supports prql with an extension https://github.com/ywelsch/duckdb-prql
Re:Pipe Syntax in SQL
by RaftPeople on Sunday August 25, 2024 @11:37AM
(#41348054)
That's a great list of friendlier sql in DuckDB. For most of that list I either run into it regularly or have wanted the exact fix they have.
I don't love the multiple WHEREs.