Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> but sanitization is completely ignored in the post, and should at least be mentioned

Why do you need a sanitization for bind parameters?



Because type correctness does not imply branch correctness. SQL has side effects of interpretation, and any string/query builder that is not aware of grammatical implications should be avoided in my opinion.

Check the query builder of sqlx [1]

[1] https://github.com/launchbadge/sqlx/blob/main/sqlx-core/src/...


I clearly don't understand something about implications. Could you please elaborate or give a link to read about it? What is branch correctness? How could it be exploited? How does sanitization prevent it?

sqlx looks like a usual builder, I don't see nothing criminal about it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: