Re: [Boost-users] Library Interface Design

From: loufoque (mathias.gaunard_at_[hidden])
Date: 2006-09-12 08:26:32

Scott Meyers wrote :

>  > An example:
>  > System.Data.SqlClient.SqlParameter is a class that describes a bound 
> parameter used in a database statement. Bound parameters are essential 
> to prevent SQL injection attacks. They should be exceedingly easy to use 
> since the "competition" (string concatenation of parameters into the SQL 
> statement) is easy, well understood, and dangerous.

You can construct safe SQL queries with streams or printf-like syntax easily
sql << "select first_name, last_name, date_of_birth "
        "from persons where id = " << id

No need to put objects everywhere that complexify everything.