Skip to content

Commit 77ab2c4

Browse files
committed
Clarify about perf and tag tamplate
1 parent 1ff14bc commit 77ab2c4

1 file changed

Lines changed: 8 additions & 1 deletion

File tree

README.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,9 @@ await db.exec`DELETE FROM users WHERE id = ${id}`
170170
setLoader(false)
171171
```
172172
173-
Note that both `store` and `exec` don’t have brackets, since it is [tag template](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates). They automatically use parameterized queries for any `${}` to prevent _SQL injection_:
173+
Note that both `store` and `exec` don’t have brackets, since it is
174+
[tag template]. They automatically use parameterized queries for any `${}`
175+
to prevent _SQL injection_:
174176
175177
```ts
176178
let value = "' OR '1'='1"
@@ -181,6 +183,11 @@ let $secrets = db.store`SELECT * FROM secrets WHERE data = ${value}`
181183
// The database receives them separately — the param is not part of the query.
182184
```
183185
186+
In additional to security, it also helps with performance, since param-less query (with `?`) can be compiled by database and compiled version then can be
187+
used with different params.
188+
189+
[tag template]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates
190+
184191
## Usage with Drizzle
185192
186193
Install [Drizzle ORM](https://orm.drizzle.team/):

0 commit comments

Comments
 (0)