Post #2931594
2026-04-02 09:13 UTC
@craigfrancis@mastodon.social As far as I'm aware, there is indeed nothing like this. We could consider adding it, though, if the case is strong enough.
My instinct would be for library APIs to deal entirely in ASTs, and never parse strings at runtime. C#'s LINQ seems to show that this is possible (even without the fancy SQL-like syntax sugar, the query builder methods seem quite serviceable and expressive). Are there problems with this, either security-wise or practically?
Replies (1)
-
@craigfrancis@mastodon.social 2026-04-02 09:34
@mudri@mathstodon.xyz ideally it wouldn’t use parsed strings (must confess I normally deal with higher level languages), but I find SQL gets complicated without the SQL syntax (e.g. trying to use function calls to create a WHERE clause), and some query builders still use SQL string fragments where user values shouldn’t be included: https://github.com/craigfrancis/php-is-literal-rfc/blob/main/justification/mistakes.php