Hacker News Reader

It'd have helped this specific case where we can know that all the arguments must be numbers, but you're going to hit the same injection issue as soon as you need to allow a string argument.

The general fix is bound parameters, not typed arguments.

View on HN

You could probably use a static type system to ensure you're not allowing string arguments from untrusted input and possibly even allow string constants to be used as arguments. Not that I think this provides any sort of advantage (or that I've even seen this), but it seems like it would be possible and work.

porque-no-los-dos.gif

I guess that there's a principled argument against strong typing, but I can't think of one against bound parameters. :D

Not an argument per-se, but there were cases where I had to manually build raw query parameter-values when using the `IN(v1, v2, v3)` operation. Many libraries still do not support passing in a list parameter as of 2021, even newer ones. For example, the Rust MySQL library.

I felt much safer doing that knowing the parameters I'm concatenating are integers.

Reply on news.ycombinator.com