alt Hacker NewsTo construct dynamic sql queries to have to string concatenate at least some parts, .
User data should of course be passed via prepared statements.
Replies
formerly_proven • yesterday at 11:37 AM
Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
➕ show 1 reply
One usually uses "query builder" pattern for that.
Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.