undefined | Better HN

0 pointsboxed2y ago0 comments

Sounds like just begging for SQL injection attacks.

0 comments

Values were still provided separately. The string-interpolated SQL would include a placeholder just like static SQL does. That's pretty easy to audit for in code review: no variables in interpolated code.

boxedOP2y ago

That makes no sense. What are you interpolating? Some variable. And you now have to audit that THAT VARIABLE is safe.

squeaky-clean2y ago

    sortable_fields = ["name", "age", "gpa"]
    
    selected_filter = sortable_fields[form.filterIndex]

    if form.sortBy == "asc":
      query += "ORDER BY {} ASC"
    elif form.sortBy == "desc":
      query += "ORDER BY {} DESC"

Doesn't have any opportunity for SQL injection unless you have rogue programmers able to change code running in prod.

nicoburns2y ago

> What are you interpolating? Some variable.

Nope, I'm generally interpolating an inline expression consisting entirely of string literals.

1 more reply

ZitchDog2y ago

You can avoid this entirely with JavaScript's tagged template literals. Here is an example library: https://github.com/blakeembrey/sql-template-tag

j / k navigate · click thread line to collapse

0 comments

nicoburns2y ago

boxedOP2y ago

That makes no sense. What are you interpolating? Some variable. And you now have to audit that THAT VARIABLE is safe.

squeaky-clean2y ago

    sortable_fields = ["name", "age", "gpa"]
    
    selected_filter = sortable_fields[form.filterIndex]

    if form.sortBy == "asc":
      query += "ORDER BY {} ASC"
    elif form.sortBy == "desc":
      query += "ORDER BY {} DESC"

Doesn't have any opportunity for SQL injection unless you have rogue programmers able to change code running in prod.

nicoburns2y ago

> What are you interpolating? Some variable.

Nope, I'm generally interpolating an inline expression consisting entirely of string literals.

1 more reply

ZitchDog2y ago

You can avoid this entirely with JavaScript's tagged template literals. Here is an example library: https://github.com/blakeembrey/sql-template-tag

j / k navigate · click thread line to collapse