Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

With proper escape (un-taint) on any user input, right?


Of course. If it is SQL you ride on JDBC already supporting placeholders, so there isn't any need for you to support substitutions for ordinary SQL.

If you want to do more complex "Dynamic SQL", say you are writing a query builder where people can fill out fields to do a complex query, your best bet is JooQ, which I use heavily at work.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: