The syntax for the string template surprised me. Are there other languages that use a `STR.` prefix to indicate string formatting?
Users can define their own template processors to control how the interpolation behaves: sanitize inputs, etc.
This part honestly seems like overengineering. Like Java architects resisted operator overloading for decades, and now they pull off this in the first version of templated strings ...
This has existed in JavaScript and Scala for years, and is a very useful feature.
Like for SQL queries:
sql`SELECT * FROM account WHERE name = ${name}`Personally I write JavaScript daily, and I've never seen this feature being used.
Even this example - will this create a prepared statement or insert a correctly escaped value into the SQL string?
Either way this seems pretty niche. Are there some major use cases for it?
I see it be used for SQL specifically in loads of projects.
https://www.npmjs.com/package/sql-template-strings
https://www.npmjs.com/package/squid
> will this create a prepared statement or insert a correctly escaped value into the SQL string?
Always prefer server-side parameterization. If you are referring to java.sql.PreparedStatement specifically, that requires a connection, so this is only an intermediate value to creating that.
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
> Even this example - will this create a prepared statement or insert a correctly escaped value into the SQL string?
That tagged template doesn't evaluate to a string, it evaluates to a parameterized query object that contains the parameterized query string and the parameter values. You pass it to the mysql library and it executes the parameterized query.
const query = SQL`SELECT author FROM books WHERE name = ${book} AND author = ${author}`
typeof query // => 'object'
query.text // => 'SELECT author FROM books WHERE name = $1 AND author = $2'
query.sql // => 'SELECT author FROM books WHERE name = ? AND author = ?'
query.values // => ['harry potter', 'J. K. Rowling']Not at all.
Thanks for the explanation, so it's not just escaped param substitution.
Which brings up the question if you can combine normal text substitution with SQL substitution, e.g.:
SELECT author FROM books WHERE name LIKE '%${book}%' AND author = ${author} AND ${extraCondition}
const query = SQL`SELECT * FROM books`
if (params.name) {
query.append(SQL` WHERE name = ${params.name}`)
}
query.append(SQL` LIMIT 10 OFFSET ${params.offset || 0}`)
db.query(SQL`SELECT * FROM "`.append(table).append(SQL`" WHERE author = ${author} ORDER BY ${column} `).append(order))It runs the sql function, with separation between the static string parts and the dynamic values, and it returns whatever the sql function returns.
It's just really useful if you can have an API that can decide how interpolated stuff gets handled. You can santize, do custom formatting, lazy evaluation, all sorts of fun stuff.
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
The new java way is strange, but maybe it was to avoid having to touch the language parser too much.
STR"x=\{x}"