Repository navigation
Fragments interpolation #10
Description
How to inject a raw string and omit interpolation, for example I'd like for f1, f2 to be just injected as string and fun interpolate is not called for them, only for $id
val fr1 = "name, age, pic"
val fr2 = "LEFT JOIN blah .."
sql("SELECT $fr1 FROM users $fr2 WHERE id = $id")
Activity
deusaquilus commentedon Jun 24, 2025
I don't allow raw-string injection, that's point. The second I allow raw-string injection you can potentially get SQL-injection vunerabilities. Do you need completely dynamic strings?
RobertoUa commentedon Jun 24, 2025
It works in Doobie.
Anyway, I looked at terpal-sql and I found your way to concatenate fragments.
deusaquilus commentedon Jun 24, 2025
Interesting! I didn't know doobie was fine with strings not prefixed with
sql"...". I was thinking about introducing a dynamic-string splicing API but an explicit one e.g.sql("....dynamic(...)...").RobertoUa commentedon Jun 25, 2025
ah, sorry, bad example. What I mean is just concatenating, not thinking about a specific way to do it (prefixing, wrapping, etc).
Strings should definitely be prefixed with
sql(orfrin doobie).Updated example.