Post #2931595
2026-04-02 09:34 UTC
@mudri@mathstodon.xyz ideally it wouldn’t use parsed strings (must confess I normally deal with higher level languages), but I find SQL gets complicated without the SQL syntax (e.g. trying to use function calls to create a WHERE clause), and some query builders still use SQL string fragments where user values shouldn’t be included:
https://github.com/craigfrancis/php-is-literal-rfc/blob/main/justification/mistakes.php
Replies (1)
-
@craigfrancis@mastodon.social 2026-04-02 09:36
@mudri@mathstodon.xyz it’s a similar problem with HTML, where templating libraries take HTML string fragments that shouldn’t contain user values; in Go there is `safehtml`: https://github.com/google/safehtml Where they use the "un-exported string type" to ensure the HTML fragments are there during compile time: https://github.com/craigfrancis/php-is-literal-rfc/blob/main/others/go/index.go