Hacker News Reader

> but sanitization is completely ignored in the post, and should at least be mentioned

Why do you need a sanitization for bind parameters?

Because type correctness does not imply branch correctness. SQL has side effects of interpretation, and any string/query builder that is not aware of grammatical implications should be avoided in my opinion.

Check the query builder of sqlx [1]

[1] https://github.com/launchbadge/sqlx/blob/main/sqlx-core/src/...

I clearly don't understand something about implications. Could you please elaborate or give a link to read about it? What is branch correctness? How could it be exploited? How does sanitization prevent it?

sqlx looks like a usual builder, I don't see nothing criminal about it.

Reply on news.ycombinator.com