Hacker News Reader

Isn't the actually proper way to use prepared statements anyway? If we are doing that properly, then what does this t string business buy us for SQL usage from Python?

View on HN

Because, as the article states, people aren’t using prepared statements. Instead, they pass f-strings because they’re more convenient.

f strings are syntax rather than a type, the resulting templates look like a reasonable way to specify a prepared statement.

Except to maintain backwards compatibility we're probably going to get new methods that only accept templates, completely circumventing any effort to stop people passing in strings.

Prepared statements were the recommended way to run SQL queries when I was starting with PHP 15 years ago, anyone writing code vulnerable to SQL injection at this point should not be writing code.

Well yes but the alternative is to never make language improvements because legacy code exists.

Reply on news.ycombinator.com