undefined | Better HN

0 pointspfooti11y ago0 comments

Huh, wow. I hadn't realized template strings can be used that way in ES6. Here I was ready to snark about sql injection. Instead I ended up learning that you can really tweak how these template strings get compiled into code, in such a way that you totally end up actually emitting $1 $2 stuff.

That's pretty awesome - I am using a SQL generation library (knex.js), which I'm admittedly happy with, but primarily because I don't like dealing with $1 $2 $3 in my own code.

Now if you had a way to programmatically expand an array (for an IN ($1 $2 $3) type of query where the array length isn't known ahead of time), I really wouldn't need to use knex.

0 comments

3 comments · 2 top-level

qooleot11y ago· 1 in thread

RE: expand array for in-clause, its definitely not supported automatically by node-postgres:

http://stackoverflow.com/questions/10720420/node-postgres-ho... https://github.com/brianc/node-postgres/issues/431

which I confirmed:

promise catch err: { [error: invalid input syntax for integer: "{"45","56","33"}"]

but I can make this work by altering my 'sql' tagged template string function, and inspect for typeof <var> array and automatically expand. I wonder if there are there other purposes for arrays other than the in-clause syntax that I should check for.

qooleot11y ago

Followup on this. To avoid the in/not-in <array> expansion, the trick is actually to use:

foo=any($1)

where $1 is an array instead of in ($1, $2, etc.). != any($1) is the same as 'not in'.

Arnavion11y ago

>Huh, wow. I hadn't realized template strings can be used that way in ES6.

That feature ("tagged" template strings) is designed primarily for "escape text for X" usage. Usually X is HTML, but it can also be SQL of course.

j / k navigate · click thread line to collapse