[Tenoke]

I don't see what it adds over f-string in that example?

[ds_]

The execute function can recognize it as a t-string and prevent SQL injection if the name is coming from user input. f-strings immediately evaluate to a string, whereas t-strings evaluate to a template object which requires further processing to turn it into a string.

[Tenoke]

Then the useful part is the extra execute function you have to write (it's not just a substitute like in the comment) and an extra function can confirm the safety of a value going into a f-string just as well.

I get the general case, but even then it seems like an implicit anti-pattern over doing db.execute(f"QUERY WHERE name = {safe(name)}")

[teruakohatu]

If I pass an f-string to a method, it just sees a string. If I pass a t-string the method can decide how to process the t-string.

[sureglymop]

Wouldn't this precisely lead to sql injection vulnerabilities with f-strings here?

[burky]

f-strings won’t sanitize the value, so it’s not safe. The article talks about this.

[Tenoke]

The article talked about it but the example here just assumes they'll be there.

[sim7c00]

it makes it so people too lazy to make good types and class will be getting closer to sane code without doing sane code...

imagine writing a SqL where u put user input into query string directly.

now remember its 2025, lie down try not to cry.

[evertedsphere]

safety against sql injection