Hacker News Reader

Comment by porsager | Hacker News Reader

They've looked at Postgres.js (https://github.com/porsager/postgres) before — wouldn't mind if they enabled those other cases in the same way.

Also, node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...

View on HN

> node-postgres is ripe for sql injections because you just concatenate strings yourself when using it...

Why the heck would you do that?

I guess for any library that accepts SQL, someone might concatenate strings rather than use the parameter handling.

The things I've seen because people don't want to learn an ORM's (or similar tech) API.

I mean that node-posgres doesn't encourage anyone to include parameter values through string concatenation, at least no more than porsager or other SQL-based clients.

Not sure what ORMs have to do with it. They do include a safe parameter substitution mechanism, but so do typical SQL-based clients.

It doesn't explicitly encourage you to do it, but it's very much right there - waiting to happen because you always just pass a string to the query function? In Postgres.js you have to use a function that is specifically named `unsafe` to do that.

The examples on https://node-postgres.com/features/queries clearly show how to use parametrized queries. Of course you /can/ concatenate strings, no library in the JS land will prevent you from doing that. But the examples are pretty clear how to do it correctly.

Well that's exactly what Postgres.js will do for you ;)

Reply on news.ycombinator.com