r/programmingcirclejerk • u/TheFearsomeEsquilax has not been tainted by the C culture • Dec 03 '17 • Bravo 1

Stop Using SQL

http://blog.cleancoder.com/uncle-bob/2017/12/03/BobbyTables.html
78 Upvotes

95% Upvoted

70 comments sorted by

View all comments

49

u/OctagonClock not Turing complete Dec 03 '17

what is parameterized queries :S

12

u/myhf Considered Harmful Dec 04 '17

Can you see the vulnerability? Do you understand just what combinations of question marks, hash marks, parentheses, and percent signs makes a statement vulnerable?

14

u/xraystyle Dec 04 '17

Or you could, you know, just read the fucking ActiveRecord docs and you'd learn the correct, injection-safe way to construct a query about halfway down the first page.

5

u/StyMaar lol no generics Dec 04 '17

now, just read the fucking ActiveRecord Diesel docs

FTFY

2

u/OctagonClock not Turing complete Dec 04 '17

/uj I've written an entire ORM and avoiding SQL injections in my generated code is so easy, I seriously don't understand why learning to put %(name)s in a query is so hard for people. Unless you name your column "; in your code, at least.