Hacker News Reader

I held out hope that maybe there was some sort of special treatment for that parameter. But then I looked at the source and... nope, it's just slapped on the end of the command.

View on HN

I couldn't remember, but checked - I am replacing ' with _ in the actual code https://github.com/mapmeld/fortran-machine/blob/master/marsu...

Generating an SQL string with any input from the user is not accepted best practice, even if that were a sufficient way to achieve it (I suspect it would disallow a parameter string to contain a legitimate, escaped ' character).

Generally, it is recommended that you create a prepared statement entirely from static SQL string(s) (no user input) and then bind parameters into it, such that there is no possibility for any user input to be parsed as SQL:

https://www.sqlite.org/c3ref/stmt.html

Reply on news.ycombinator.com