Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It also allow for things that will set off spidey senses in programmers everywhere despite theoretically being completely safe assuming mydb::sql() handles escaping in the format string:

   cursor = mydb::sql(f"UPDATE user SET password={password} WHERE user.id={userid}")


Yeah. You really want "mydb::sql" to not take a basic_string, only a basic_formatted_string, so it will not compile if the conversion actually happened somehow.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: