January 25

On Thursday, 25 January 2024 at 16:37:07 UTC, novice2 wrote:

>

IMHO, string interpolation should no be used for DB code.

Version proposed here indeed should not be used. Dip 1036e, as far as I understood, can be used and does provide some security benefits against sql injection, given sql library in question uses interpolated strings. I think we should stop discussing this proposal, since dip1036 is already accepted.

If you're curious how interpolated strings might help with sql injection check recent debates about interpolated strings, there are plenty of examples.

January 25

On Thursday, 25 January 2024 at 07:47:53 UTC, Kagamin wrote:

>

On Thursday, 18 January 2024 at 23:05:03 UTC, Alexandru Ermicioi wrote:

>

You will, but first, you'd get your company software breached, so perhaps it is best to not allow such things in first place (language).

You mean the current way

query("select * from student where name='"~bobby~"'");

is ugly enough that nobody will use it accidentally?

Perhaps someone will, which is sad. Still, not an argument to introduce yet another way at concatenating strings (suggested here), which imho is even easier than your example to use.

January 26

On Thursday, 25 January 2024 at 17:27:51 UTC, Alexandru Ermicioi wrote:

>

Perhaps someone will, which is sad. Still, not an argument to introduce yet another way at concatenating strings (suggested here), which imho is even easier than your example to use.

"yes a sharp hammer is the wrong tool to tighten a screw, so hammers shouldnt exist"

I just want a dumb thing that makes string concat shorter and nicer to write, for when you write string concat, there was these highly technical debate about purely theatrical use that lasted for 6 years and was a straw that broke the camels back for a community split.

Yes my suggestion provides nothing for sql, that was the point I wasnt pretending it did.

1 2
Next ›   Last »