Hacker News Reader

I agree, end-to-end tests have been really valuable for catching SQL issues in my experience.

> Identify unsafe queries that could potentially lead to SQL injections

This feature seems like a perfect use case for static analysis and would be a great tool in addition to automated tests.

And static analysis is not limited to build time so it can provide value even earlier.

Or later, if your program grows from a small hack to an important application.

Just don't use string mangling to combine parameters and queries. The most is switch/case in a loop or something like it doing state machine execution to combine fixed strings. And that only because one does not accidentally build something general enough to allow for SQL injection with such harsh restrictions.

This can even be done locally if your tests start and populate an in-memory database like Derby. Before anyone says it, I’m not talking about ordinary unit tests, but they can be part of the test suite.

With embedded databases, I'm fine of not just checking syntax of queries, but the logic that relies on the store.

Not a panacea, but very nice regardless.