support #$ interpolation for dynamic sql such as table names, order clause, etc
See original GitHub issueLove relate and the SqlResult parsing is much cleaner than anorm. One thing missing is #$ interpolation which is supported by anorm and slick. Its helpful for use cases like dynamic table names, order clauses, etc:
val accountId = 2
val orderCol = "foo"
val orderDir = "desc"
sql"select name, sum(foo) as foo, sum(bar) as bar from table where account_id = $account_id group by name order by #$orderCol #$orderDir"
I have a quick and dirty commit which unblocks me for now, would remove this for official version if/when supported: https://github.com/xadrnd/relate/commit/40e176617280e836ab5a6c6a7babbef3e04a47e5
Thanks!
Issue Analytics
- State:
- Created 9 years ago
- Comments:5 (2 by maintainers)
Top Results From Across the Web
How to set table name in dynamic SQL query? - Stack Overflow
Open to SQL injection. All you need to do is pass a bad @TableName parameter such as 'sys.databaeses; Alter Server Role sysadmin Add...
Read more >7 Performing SQL Operations with Native Dynamic SQL
You can build statements where you do not know table names, WHERE clauses, and other ... and extra features such as support for...
Read more >Placeholder Text (String Interpolation) in T-SQL
Dynamic SQL often involves creating queries by combining strings of SQL code with data from the database. Before we start, I'm going to...
Read more >Basic module usage — Psycopg 2.9.5 documentation
Passing parameters to an SQL statement happens in functions such as ... dynamically SQL queries (for instance choosing dynamically a table name) you...
Read more >Postgres plpgsql - Using a variable inside of a dynamic create ...
You cannot use parameters for table/column names - that's because Postgres needs to be able to parse query on compiling the dynamic SQL...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
@rfranco, that is actually already implemented 😉
InterpolatedQuery
is aMultiParameter
, which is aParameter
.@rbanikaz, see https://github.com/lucidsoftware/relate/wiki/Query-Interpolation#query-composition.
(FYI, if for some reason you aren’t constructing your queries with literal strings, an arbitrary string can be converted to a query by calling
.toSql
on it. Of course, you should only do this with trusted data.)I like this approach to interpolation, as it encodes the semantics of the data – text data, or SQL query – in the type. It avoids the “String as universal data type” smell, and it makes accidental SQL injection more difficult.
Let me know if you find this reasonable.
Cool thanks! I didn’t know about the toSql, that’s helpful at least it covers the use case.
I do think the #$ is nice, I didn’t spend much time going through your codebase, but I will go ahead and submit the PR, it will be great if you take a look I will be happy to respond to comments…
Cheers!