Hacker News Reader

There’s this whole thread about string handling. Does the Rust API into SQLite not support prepared statements?

You can insert arguments into an SQL statement with the (?1) style syntax. See the example here:

https://docs.rs/rusqlite/latest/rusqlite/

no, but the guy can also look at postgres.js that already implmented alot of the sql`SELECT * FROM ${table_name}` Where there vars are escaped. It ONLY works for postgres, but I'm sure you can make it work with SQLite as well.

It does: https://docs.rs/rusqlite/latest/rusqlite/struct.Statement.ht...

Mucking about with SQL strings, to me, is akin to writing your own crypto: Don't. Unless you must (because, say, it doesn't exist yet.) Doing this is asking for security problems later. Trust that the SQLite team (or any other SQL engine) have more experience and have provided a correct interface. And if that interface isn't correct, don't just run off an make your own- contribute a fix so we can keep all the lessons learned together.

Reply on news.ycombinator.com