Crate concatsql

Expand description

ConcatSQL

concatsql is a secure library for PostgreSQL, MySQL and SQLite.
Unlike other libraries, you can use string concatenation to prevent SQL injection.

use concatsql::prelude::*;

fn main() {
    let conn = concatsql::sqlite::open(":memory:").unwrap();
    conn.execute(r#"
            CREATE TABLE users (name TEXT, age INTEGER);
            INSERT INTO users (name, age) VALUES ('Alice', 42);
            INSERT INTO users (name, age) VALUES ('Bob',   69);
    "#).unwrap();

    let age = String::from("42");  // user input
    let sql = query!("SELECT name FROM users WHERE age = {age}");
    // At runtime it will be transformed into a query like
    assert_eq!(sql.simulate(), "SELECT name FROM users WHERE age = '42'");
    for row in conn.rows(&sql).unwrap() {
        assert_eq!(row.get(0).unwrap(),      "Alice");
        assert_eq!(row.get("name").unwrap(), "Alice");
    }

    let age = String::from("42 OR 1=1; --");  // user input
    let sql = query!("SELECT name FROM users WHERE age = {age}");
    // At runtime it will be transformed into a query like
    assert_eq!(sql.simulate(), "SELECT name FROM users WHERE age = '42 OR 1=1; --'");
    conn.iterate(&sql, |_| { unreachable!() }).unwrap();
}