Sanitize inputs about deno-drash-realworld-example-app HOT 7 CLOSED

We could just change special characters to entities before they go into the database and then convert them back when we retrieve them

from deno-drash-realworld-example-app.

Do you have an idea of how this would be implemented? I'm used to using PDO or having the framework used do this, but not manually

from deno-drash-realworld-example-app.

Course nice, one, i was thinking of the whole query which is where i was going wrong

So i guess the end result would be:

• All CRUD methods would call a new escapeQueryData method (or whatever name is best) before calling this.prepare
• SELECT method would call a unescapeDBResult (or whatever name is best) to unescape the data at the end of the method, before returning it

from deno-drash-realworld-example-app.

Asked in pgc4d and deno-postgres to see if they currently have sanitisation implemented, or any plans to. Mainly because it would save us a job of doing it manually.

Note that there is another postgres module mentioned but by no means am i suggestion it, just trying to get as much info as possible

from deno-drash-realworld-example-app.

Author of pgc4d replied here, and they do encode queries when used with placeholders

from deno-drash-realworld-example-app.

Seems like deno-postgres does: await client.query("SELECT * FROM ids WHERE id < $1;", 2). Worth checking as hadn't had any confirmation from the owner

from deno-drash-realworld-example-app.

Postgress currently doesn't, but they do parameterise queries so it means we can strip out logic we have added to do that

from deno-drash-realworld-example-app.