sql

All things SQL and JDBC...
Norman Ziebal 2020-12-27T01:57:44.011400Z

Heya, I have a short question about java.jdbc. In the example this is provided:

(j/query mysql-db
  ["select * from fruit where appearance = ?" "rosy"]
  {:row-fn :cost})
Are all arguments escaped in order to prevent sql injections? (I am sorry maybe its trivial, but I wasn't able to find anything regarding escaping in the docs 😞 )

2020-12-27T02:45:18.013700Z

Under the hood clojure.java.jdbc and next.jdbc both use PreparedStatement objects, which you can read about here: https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html

2020-12-27T02:46:34.014400Z

The relevant bit is "Prepared statements always treat client-supplied data as content of a parameter and never as a part of an SQL statement."

Norman Ziebal 2020-12-27T15:17:17.016600Z

Thank you!