[OT] C# can do all the interpolated strings now

kdevel kdevel at vogtner.de
Wed Dec 8 21:31:35 UTC 2021


On Wednesday, 8 December 2021 at 13:28:33 UTC, Dennis wrote:
> On Wednesday, 8 December 2021 at 12:55:02 UTC, Adam D Ruppe 
> wrote:
>> there's another good document mostly written but waiting on 
>> john and andrei to take the next step.........
>
> https://github.com/John-Colvin/YAIDIP

Does Dlang now support SQL injection?

Quotes from https://github.com/John-Colvin/YAIDIP:

```
void f2(string name) {
     htmlOutput("Looking for #{}...", name);                  // 
specifier is #{}
     auto rows = sql("SELECT * FROM t WHERE name = ?", name); // 
specifier is a question mark
     ...
}
````
This is an SQL query written lege artis. It enables the sql 
function to do whatever is necessary to perform the request 
without unwanted "side effects".

Further down we must read this:

```
void main(string[] args) {
     import std.stdio;
     writeln(i"The program $(args[0]) received $(args.length - 1) 
arguments.");
     // Lowering: --->
     // writeln(InterpolationHeader!("The program ", "args[0]", " 
received ", "args.length - 1", " arguments.")(),
     //     "The program ", args[0], " received ", args.length - 
1, " arguments.");

     auto s = sqlExec(i"INSERT INTO runs VALUES ($(args[0]), 
$(args.length - 1))");
     // Lowering: --->
     // auto s = sqlExec(InterpolationHeader!("INSERT INTO runs 
VALUES(", "args[0]", ", ", "args.length - 1", ")")(),
     //    args[0], $(args.length - 1));
}
```

How is the proper separation of code (query) and data achieved in 
this case?

To me

    auto argsmaxidx = args.length - 1;
    auto s = sqlExec("INSERT INTO runs VALUES (?, ?)", args [0], 
argsmaxidx);

appears way more readable.


More information about the Digitalmars-d mailing list