db/get-paste-by-id is giving me a 'spicy' edn file with a #object i dunno how to (and don't want to) print.
(http/defroutes main-routes
(http/GET "/" [] (views/index-page))
(http/POST "/" req
(if (empty? (:body (:params req)))
(views/index-page)
(do
(let [ins (db/create-paste req)
id (db/get-last-paste)]
(str ixio/url(:id (first id)) "\n"
#_req)))))
(http/GET "/favicon.ico" []
"Hello World")
(http/GET "/:id" [id]
(views/individual-paste id)
#_(db/get-pastes-by-id id))
(route/resources "/")
(route/not-found "Page not found"))
(defn get-paste-by-id [id]
(let [query-string (str "SELECT id,body FROM pastes WHERE id="id ";")]
(query my-db [query-string])))
(defn individual-paste [row]
(page/html5
(:body
(clojure.edn/read-string
(str (first (db/get-paste-by-id row)))))))
Just now seeing this. Thank you for the safety advice!
Prints out a bunch of stuff but I think the offending object is
:body #object[org.eclipse.jetty.server.HttpInput 0x451be3bd "org.eclipse.jetty.server.HttpInput@451be3bd"]
And when I try to turn the string into an edn format it complains about #object@mksybr This is very unsafe:
(let [query-string (str "SELECT id,body FROM pastes WHERE id="id ";")]
(query my-db [query-string]))
You're opening yourself up to SQL injection attacks by doing that. Do thing instead, so you get a parameterized SQL query:
(query my-db ["SELECT id,body FROM pastes WHERE id = ?" id])
You should always use parameterized queries, instead of constructing an entire SQL string that includes its parameters!