December 09, 2021

On Thursday, 9 December 2021 at 13:03:21 UTC, Ola Fosheim Grøstad wrote:

>

On Thursday, 9 December 2021 at 12:43:31 UTC, Adam D Ruppe wrote:

>

[...]

But don't you think it would be better if you could write:

[...]

auto sqlstring = sql!i"SELECT x,y,z FROM {something} FROM {condition}";

December 09, 2021
On Thursday, 9 December 2021 at 13:03:21 UTC, Ola Fosheim Grøstad wrote:
> But don't you think it would be better if you could write:

No.
December 09, 2021

On Thursday, 9 December 2021 at 13:07:20 UTC, mork wrote:

>

auto sqlstring = sql!i"SELECT x,y,z FROM {something} FROM {condition}";

A bit clunky. With a custom interpolation function you could overload on the return type and have domain specific syntax.

December 09, 2021

On Thursday, 9 December 2021 at 13:24:14 UTC, Adam D Ruppe wrote:

>

On Thursday, 9 December 2021 at 13:03:21 UTC, Ola Fosheim Grøstad wrote:

>

But don't you think it would be better if you could write:

No.

How is:

sql(i"SELECT $(r[0]), $(r[3]), FROM $(t[3]) WHERE $(c[6])")

An improvement over:

sql("SELECT", r[0], r[3], "FROM", t[3], "WHERE", c[6])

?

It obviously isn't!

This will end up being a marginal feature.

December 09, 2021

On Thursday, 9 December 2021 at 13:27:06 UTC, Ola Fosheim Grøstad wrote:

>

A bit clunky. With a custom interpolation function you could overload on the return type and have domain specific syntax.

DSLs are already possible with template mixins in a clean form without sigils.

December 09, 2021

On Thursday, 9 December 2021 at 14:04:18 UTC, Kagamin wrote:

>

DSLs are already possible with template mixins in a clean form without sigils.

You mean as string mixins?

December 09, 2021

On 12/9/21 2:47 AM, WebFreak001 wrote:

>

I wonder why are most languages using $ or {}? What's the advantage over \(...)?

I've used the swift syntax, and I don't like it as much. It looks somewhat clunky.

Though, really, this is just asthetics.

>

With \ we have the advantage of not reserving another special character in strings - we already use \! It'd be fully backwards compatible even without the i prefix.

There are significant problems there though. The intention of the string interpolation DIPs so far is not necessarily to generate strings but to give a mechanism to overload for string interpolations. So the i"" type is different than "" on purpose.

Also, other string types do not have escape sequences.

-Steve

December 09, 2021

On 12/9/21 5:43 AM, deadalnix wrote:

>

So I read the proposal for string interpolation in D, which I understand to be this one: https://github.com/John-Colvin/YAIDIP

The immediate thing that stroke me is the shell example. The proposed exemple is simply terrible code as it allows for shell injection.

It depends on the executeShell function that accepts interpolations. It could just text-ify the thing (convert to a string) or properly escape anything in the interpolation portions. Granted, the DIP does not discuss this possibility.

>

One of the motivating example is SQL prepared statements, but once again, replacing this by the proposed string interpolation means SQL injection.

No, it doesn't. This tells me you are missing something in your understanding of the proposal.

-Steve

December 09, 2021

On 12/9/21 8:50 AM, Ola Fosheim Grøstad wrote:

>

On Thursday, 9 December 2021 at 13:24:14 UTC, Adam D Ruppe wrote:

>

On Thursday, 9 December 2021 at 13:03:21 UTC, Ola Fosheim Grøstad wrote:

>

But don't you think it would be better if you could write:

No.

How is:

sql(i"SELECT $(r[0]), $(r[3]), FROM $(t[3]) WHERE $(c[6])")

An improvement over:

sql("SELECT", r[0], r[3], "FROM", t[3], "WHERE", c[6])

?

It obviously isn't!

What is that sql function doing? It's not just concatenating strings, and it's also not anything I would ever want to use, in original or interpolation form. It appears to suggest it's going to happily do sql injection as well.

>

This will end up being a marginal feature.

For this fictitious example, maybe. But I already see huge potential in my real actual libraries that I've written.

You don't have to use it if you don't want to.

-Steve

December 09, 2021

On Thursday, 9 December 2021 at 13:03:21 UTC, Ola Fosheim Grøstad wrote:

>

On Thursday, 9 December 2021 at 12:43:31 UTC, Adam D Ruppe wrote:

>

On Thursday, 9 December 2021 at 10:43:07 UTC, deadalnix wrote:

>

So I read the proposal for string interpolation in D, which I understand to be this one: https://github.com/John-Colvin/YAIDIP

The immediate thing that stroke me is the shell example. The proposed exemple is simply terrible code as it allows for shell injection.

You say you read it, then say something that is blatantly false about it.

This dip does NOT produce strings. It produces argument lists. The receiving function knows what was part of the string literal and what were arguments and can process them accordingly.

But don't you think it would be better if you could write:

sql"SELECT x,y,z FROM {something} FROM {condition}"

[...]

Love the idea of having type-safety with this! JS has similar syntax with sql`...` where it will call the function sql with the parts of the interpolated string.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals