Most SQL libraries in other languages that have interpolation seem to offer a named param option where parameters can be passed as a hash, which gets around the indexed-parameter issue while still properly escaping values.
That said, I'm thrilled that ES6 is finally getting string interpolation.
http://ivc.com/blog/better-sql-strings-in-io-js-nodejs-part-...
That's pretty awesome - I am using a SQL generation library (knex.js), which I'm admittedly happy with, but primarily because I don't like dealing with $1 $2 $3 in my own code.
Now if you had a way to programmatically expand an array (for an IN ($1 $2 $3) type of query where the array length isn't known ahead of time), I really wouldn't need to use knex.
http://stackoverflow.com/questions/10720420/node-postgres-ho... https://github.com/brianc/node-postgres/issues/431
which I confirmed:
promise catch err: { [error: invalid input syntax for integer: "{"45","56","33"}"]
but I can make this work by altering my 'sql' tagged template string function, and inspect for typeof <var> array and automatically expand. I wonder if there are there other purposes for arrays other than the in-clause syntax that I should check for.
foo=any($1)
where $1 is an array instead of in ($1, $2, etc.). != any($1) is the same as 'not in'.
That feature ("tagged" template strings) is designed primarily for "escape text for X" usage. Usually X is HTML, but it can also be SQL of course.
the sql`` template is actually creating a prepared statement.