Hacker News Reader

Comment by jameslk | Hacker News Reader

It's a nice feature, when used for template strings. Looking at the library, it just looks awkward:

  sq.from`book`
    .return`distinct author`
    .where({ genre: 'Fantasy' })
    .where({ language: 'French' })

I can already hear the questions:

"Why do some functions require parenthesis and some don't?" "When do I need to use parenthesis?"

It's just unnecessarily confusing.

View on HN

You're framing this as a question of syntax preference, but actually the whole point of template tags is to cater to a very specific need: the ability to sanitize an interpolated value.

In this specific example, let's say you have:

    sql.from`book`.return`distinct ${field}`

You don't want a sql injection to occur if somehow `field = 'author'; drop table book; --` or similar.

With a plain function call, the library would have no way of knowing what to sanitize.

    sql.from('book').return(`distinct ${field}`) // hello security hole

And without template tags, the API would arguably look more complex, and require the user to discover/learn an ad-hoc interpolation DSL:

    sql.from('book').return('distinct ${field}', {field})

You can still target the template tag's raw API requirements without the syntax (though you'd lose readability with multiple interpolations):

    sql.from('book').return(['distinct'], field)

Fair enough. I primarily use it for GraphQL queries. Each of my queries exist in a file queryName.jsx. Those files consist of the following code:

  import gql from 'graphql-tag';
  
  export default gql`
    query Blah($var: VarType!) {
      blah(var: $var) {
        id
        etc
      }
    }
  `;

I like it. Not confusing to me or anyone on my team. To each their own.

Reply on news.ycombinator.com