Could’ve been long ago
Could’ve been long ago
Posted Apr 23, 2025 7:29 UTC (Wed) by iabervon (subscriber, #722)In reply to: Could’ve been long ago by xi0n
Parent article: Template strings accepted for Python 3.14
While it is mostly not functionally different from format_args!(), it's actually a huge ergonomic benefit to be able to write the arguments interleaved with the string literal text. For example, this allows for writing code that doesn't have SQL injection vulnerabilities that is actually more obvious and readable than code that does have SQL injection vulnerabilities. You've had to tell people why they must not write "SELECT * FROM users WHERE name='"+name+"' AND password='"+password'";", or f"SELECT * FROM users WHERE name='{name}' AND password='{password}';", and have to instead write execute("SELECT * FROM users WHERE name={} AND password={};", name, password), which is harder to read but actually secure. But now they can use t"SELECT * FROM users WHERE name={name} AND password={password};" and the code you can read in order without any extra quotes is actually correct.
