[OT] C# can do all the interpolated strings now
kdevel
kdevel at vogtner.de
Wed Dec 8 21:31:35 UTC 2021
On Wednesday, 8 December 2021 at 13:28:33 UTC, Dennis wrote:
> On Wednesday, 8 December 2021 at 12:55:02 UTC, Adam D Ruppe
> wrote:
>> there's another good document mostly written but waiting on
>> john and andrei to take the next step.........
>
> https://github.com/John-Colvin/YAIDIP
Does Dlang now support SQL injection?
Quotes from https://github.com/John-Colvin/YAIDIP:
```
void f2(string name) {
htmlOutput("Looking for #{}...", name); //
specifier is #{}
auto rows = sql("SELECT * FROM t WHERE name = ?", name); //
specifier is a question mark
...
}
````
This is an SQL query written lege artis. It enables the sql
function to do whatever is necessary to perform the request
without unwanted "side effects".
Further down we must read this:
```
void main(string[] args) {
import std.stdio;
writeln(i"The program $(args[0]) received $(args.length - 1)
arguments.");
// Lowering: --->
// writeln(InterpolationHeader!("The program ", "args[0]", "
received ", "args.length - 1", " arguments.")(),
// "The program ", args[0], " received ", args.length -
1, " arguments.");
auto s = sqlExec(i"INSERT INTO runs VALUES ($(args[0]),
$(args.length - 1))");
// Lowering: --->
// auto s = sqlExec(InterpolationHeader!("INSERT INTO runs
VALUES(", "args[0]", ", ", "args.length - 1", ")")(),
// args[0], $(args.length - 1));
}
```
How is the proper separation of code (query) and data achieved in
this case?
To me
auto argsmaxidx = args.length - 1;
auto s = sqlExec("INSERT INTO runs VALUES (?, ?)", args [0],
argsmaxidx);
appears way more readable.
More information about the Digitalmars-d
mailing list