scala - Slick string sanitation -
i want perform query using sql operation string parameter. example:
coffee <- coffees if coffee.name s"%$querystring%"
is safe?
from slick documentation :
slick’s key feature type-safe, composable queries. slick comes scala-to-sql compiler, allows (purely functional) sub-set of scala language compiled sql queries [...]
the fact such queries type-safe not catches many mistakes @ compile time, eliminates risk of sql injection vulnerabilities
i did no try myself, think safe when using user params
Comments
Post a Comment