Hacker News Reader

Comment by stcredzero | Hacker News Reader

One thing that I've noticed in the Golang community, is that there is some disturbingly large number of programmers there who think it's a very good idea not to use prepared statements and instead to use Input Escaping.

https://www.reddit.com/r/golang/comments/62513u/golang_persi...

The justification? Better performance. Didn't the PHP community go through the exact same thing years ago? (With people finally giving up and going back to prepared statements for safety against SQL injection.)

It's so widespread that there are multiple libraries that tout this as a feature!

View on HN

I have not noticed this reviewing code for clients, and would be equally disturbed --- anyone suggesting that prepared statements should be avoided in favor of escaping is perpetuating a dangerous falsehood.

The link you posted to support your claim demonstrates exactly the contrary: the person supporting that argument has been downvoted to oblivion until they saw fit to delete their account.

As far as I can see, the last part of your assertion is false. For their username, you need to include a trailing slash.

OMG. How would escaping be faster than prepared statements if prepared statements are literally cached in the database server instead of re-parsing and re-planning every time?! o_0

To be fair, it can be faster if the binds cause the plan to be much more efficient. I've had to remove binds before for this very reason.

Note that this was exactly once in 20 years.

It happens. https://bugs.mysql.com/bug.php?id=73056

PHP's PDO database abstraction layer actually escapes by default under the hood, but it presents a prepared statement interface.

You can turn that off. It was there historically because mysql didn't always support it, and it was slow when it was first rolled out.

Other languages old enough to have been around prior to all this have the same history. Perl, Python, etc.

> It's so widespread that there are multiple libraries that tout this as a feature!

Which libraries?

AFAIK prepared statements don't let you change which table to use them for dynamically? Or am I misunderstanding something?

They don't, but they still offer better speed and security than non prepared statement.

And having to dynamically change a table name is uncommon.

Reply on news.ycombinator.com