Support query execution with named parameters about swift-kuery HOT 3 CLOSED

Do the adaptors for Kuery support Prepared Queries? Do they prevent SQL injection attacks (assuming raw queries aren't used?)

from swift-kuery.

IIUC what you mean by Prepared Queries, Connection protocol has an API for execution of a query with parameters, e.g.:

func execute(query: Query, parameters: [Any], onCompletion: @escaping ((QueryResult) -> ()))

PostgreSQL plugin implements these methods using PQsendQueryParams().
Ian is working on this in SQLite.

The purpose of passing parameters is to prevent SQL injection attacks.

BTW, I don't think the usage of raw queries means we can't prevent SQL injection: the raw queries are needed because we don't support every possible syntax the developer may want to use. The parameters are the input from the user (of the developer's app), and this input can cause an attack (not the raw query written by the developer). Therefore, we support raw queries with parameters.

from swift-kuery.

Implemented for SQLite.

from swift-kuery.