Heya, I have a short question about java.jdbc. In the example this is provided:
(j/query mysql-db
["select * from fruit where appearance = ?" "rosy"]
{:row-fn :cost})
Are all arguments escaped in order to prevent sql injections? (I am sorry maybe its trivial, but I wasn't able to find anything regarding escaping in the docs 😞 )Under the hood clojure.java.jdbc and next.jdbc both use PreparedStatement objects, which you can read about here: https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html
The relevant bit is "Prepared statements always treat client-supplied data as content of a parameter and never as a part of an SQL statement."
Thank you!