mysql

ounds of back and forth and fixups before it is accepted. This is the plan as I envision it: * Release SqlString 3.0.0 that has a new allowObjectValues parameter defaulting to false. This is a new major, so it shouldn't break anybody's code. * Release mysqljs 2.19.0 (or should it be 2.18.3 for even higher adoption?) that depends on SqlString 3.0.0 but explicitly passes allowObjectValues on every call to it,with a default of true unless the user explicitly set it to false. This is a non-breaking change. This version will also add a deprecation warning whenever a ConnectionConfig is built without explicitly setting allowObjectValues, warning that the default will change in 3.0 and suggesting to set it to false unless it's needed and highlighting the need to typecheck values if it's set to true. * Release mysqljs 3.0 that changes the default and removes the deprecation warning, so new projects get a sane default. This involves, of course, changes to two repositories, so here they are (I can't open pull requests because I have not contributed in the past): https://github.com/SonOfLilit/sqlstring https://github.com/SonOfLilit/mysql (I didn't write the mysqljs3.0 patch yet to make pull request technicalities simpler, but it's trivial) Again, I'm new to this project, am not a javascript developer in my day job, and I expect - and am prepared to handle - nontrivial amounts of feedback and requests for improvement. For a brighter, safer future :-), Aur

_(O... Prepared statements are cooked wrong as well, but rarely, that's why they are viable line of defense, but not the sole one (as nothing should be): https://www.reddit.com/r/netsec/comments/ww9qm/sqli_bypassin... https://stackoverflow.com/questions/134099/are-pdo-prepared-... (in fact, I've seen with my eyes exactly what first comment in reddit postmentions).

, it's just not pretty. The code looked good, and it was all in really small functions, but making sense of order of execution with callbacks flying all over the place proved difficult. It was possible definitely but if you looked at the logic in Java, it was just like a big sigh of relief. Not sure how to explain it but looking at code that executes like you think it would makes me happier. Luckily we didn't have too many projects done in Node and switched to Rails 6 months after and have been happy ever sense. I've revisited Node a few times, but even with generators it makes certain things blah. Specifically looping through arrays that need to execute callback code. I really, really want to like Node.JS, but it's just not there for me. For me both languages on the client and server is overrated anyway and with Angular I'm writing less Javascript then I ever have.