Hacker News Reader

Comment by borntyping | Hacker News Reader

The second function only accepts strings defined at compile time, meaning it can't be called with strings created at runtime (i.e. any string containing user input).

View on HN

So what to you do if you need to make a sql call based on user input?

Use parameters, of course. Using SQL parameters for untrusted input is the only sane way to avoid SQL injections.

just add "to_owned()" and problem solved. This function doesn't protect nothing, it's a bullshit. I love Rust, but author is far from the theme he is trying to describe. And theme is dangerous enough.

to_owned() converts to a String, not to a &'static str. Those are not the same. You can't create a &'static str dynamically (though you can mutate one using unsafe.)

lol, so you call your SQL just with constants? "username" in his example just for one user forever? Still a bullshit.

No, only the SQL statement has to be 'static. It's not bullshit.

Can you provide real-world example please?

From TFA:

let _rows = sql_query("SELECT * FROM users WHERE username=?", &[username]);

The statement is static, but the [username] part is not, it's just a variable that can have whatever username you want.

and I already told that this example has no meaning, it's just a bullshit - nobody will use it in real app. You want to fetch from db info about the only one user, who's name is a constant? Yeah, all apps do it every day.

You can convert a `String` into a `&'static str` using only safe stdlib functions via `Box::leak(s.into())`. This uses `unsafe` internally, of course... but so does almost any code.

Ah cool, I hadn't heard about Box::leak until now. Coming to stable in 1.26 it seems.

Reply on news.ycombinator.com