multi-byte utf8 characters are wrongly escaped

[mathias-baumann-sociomantic]

I was aware that the function is just a simple "good enough for now" (because I wrote it with that mindset).
I mean, it was like, better this than nothing.

However, I recently was hit by some multi-byte utf8 string that blew up on me and I reverted now to using base64 encoding.

however, we should consider doing escaping of such strings correctly.

Maybe we can take "inspiration" from this function:

https://github.com/sociomantic-tsunami/libdrizzle-redux/blob/ff7f7eaa6431a523eb68279c54fc53d4859f0066/libdrizzle/query.cc#L60-L161

[Abscissa]

In v2.1.0, it will become trivial to use implicit prepared statements (automatically registered and cached):

int i = 5;
string s = "Hello world";
conn.exec("INSERT INTO table_name VALUES (?, ?)", i, s);
conn.query("SELECT * FROM table_name WHERE id=? AND name=?", i, s);

Because of that, together with the fact that SQL string-escaping is so widely frowned upon in favor of prepared statements, I'm wondering how worthwhile it still is to even have, or to put further work into, an SQL string-escaping implementation.

[mathias-baumann-sociomantic]

I think there are some use cases where you simply can't use prepared statements. For example if you want to update a certain amount of rows identified by id's (and you don't know how many beforehand) in one single statement, you almost have to construct it at runtime.. and for such cases a good escape function is certainly useful..

[schveiguy]

Can someone post an example of which utf8 strings don't work? Disclaimer: I haven't looked at all at the implementation, but I'm sure it's not too complicated to work out.

Do we need SQL escaping? Yes we do.