refactor(sql): refactor sql queries to use prepared statements #4305
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…e resources in this commit, a the sql queries for inserting resources into the database were refactores to use prepared statements instead of simple queries this change will: - [X] add more security to the database for common attack such as sql injection
|
will take a look at it later, any help or critic to improve it would be much appreciated 😁 |
RoccoSmit
reviewed
Jan 22, 2025
| stmt := "INSERT INTO `resource` (" + strings.Join(fields, ", ") + ") VALUES (" + strings.Join(placeholder, ", ") + ")" | ||
| result, err := d.db.ExecContext(ctx, stmt, args...) | ||
| query := "INSERT INTO `resource` (" + strings.Join(fields, ", ") + ") VALUES (" + strings.Join(placeholder, ", ") + ")" | ||
| stmt, err := d.db.PrepareContext(ctx, query) |
There was a problem hiding this comment.
Are these db.PrepareContext calls needed?
The way I understand the docs is that they are intended to wrap SQL statements and are added to some form of a SQL statement file from where they can be called and reused or passed around between functions.
The way they are used in this PR does not allow for reuse and looks to me like a step that can be omitted.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
in this commit, a the sql queries for the resource domain in the database were refactored to use prepared statements instead of simple queries, as it usually, makes the project safer when exposed to public internet