Recommendation: use template literals

Node.js has node-sql-template-strings package, why can’t we have this?

Example:

// mysql:
mysql.query('SELECT author FROM books WHERE name = ? AND author = ?', [book, author])
// is equivalent to
mysql.query(SQL`SELECT author FROM books WHERE name = ${book} AND author = ${author}`)

Links: https://github.com/felixfbecker/node-sql-template-strings https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals

[invisal]

I am a bit skeptical about this feature. User can easily make a mistake. For example

mysql.query(SQL`SELECT author FROM books WHERE name = ${book} AND author = ${author}`);
// If user mistype and forgot insert SQL, it will silently go through without any warning.
mysql.query(`SELECT author FROM books WHERE name = ${book} AND author = ${author}`);

User can easily forget to put SQL in front of the query and there is no way for us to provide a warning to user. This is vulnerable to SQL injection.

I think we should just go with named placeholder instead. It is harder for user to make mistake

mysql.query('SELECT author FROM books WHERE name = :book AND author = :author', { book, author })

[algj]

May I ask what’s difference between $$ (??) with $ (?). Or u try to keep consistency with the original style. I also doesn’t get the original ?? though.

I assume ?? is used for fields, table names and other things that don’t need to be in “quotes”. ? may be used for text

Example, if you were to replace everything:

SELECT id, author, releaseDate FROM books WHERE title="Harry Potter"
SELECT ??, ??, ?? FROM ?? WHERE ??=?

Anyway u’v done a good job.

Thanks