Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Interestingly, func`123 ${abc}` is not syntactic sugar for func(`123 ${123}`) .

The latter interpolates the values into the template and passes the final string to the function as a single argument.

The former acts as shown in the article, passing the string pieces as an array and the value pieces as additional arguments. This allows SQORN to prevent SQL injection while building queries. See first FAQ on https://sqorn.org/docs/faq.html

You can also do some interesting stuff with the special ".raw" property of the string array passed. See here https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...



Worth noting also that there's nothing magical about the backtick being adjacent to the function, you can have whitespace inbetween, e.g

     func   `123 ${abc}`
or even

     func
     `123 ${abc}`
Coupled with the vagueness around ; I expect this will make for some awesomely obfuscated JavaScript in the coming years.


Even more nonsense possible since the tag function doesn't have to return a string, it can return a function, meaning you could chain these, e.g.

    function tag2(string, ...keys) {
      console.log("tag2", string, ...keys);
      return function tag1(string, ...keys) {
        console.log("tag1", string, ...keys);
        return "tag1-return-value"
      }
    }
    console.log(tag2`input to tag2``input to tag1`);
yields

    tag2 [ 'input to tag2' ]
    tag1 [ 'input to tag1' ]
    tag1-return-value


Is that not a dangerous way to prevent SQL injection? What happens if someone calls it with parentheses? Will that throw an error or will it bypass the SQL injection prevention?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: