|
|
Log in / Subscribe / Register

Could’ve been long ago

Could’ve been long ago

Posted Apr 23, 2025 7:29 UTC (Wed) by iabervon (subscriber, #722)
In reply to: Could’ve been long ago by xi0n
Parent article: Template strings accepted for Python 3.14

As compared to str.format(), there's been string.Formatter to allow for producing something other than a str and there's been f-strings to allow for writing the arguments inside the format string literal. This is essentially combining those differences (with improvements to the API from experience with string.Formatter and for the fact that Interpolation can actually be given the text of the expression).

While it is mostly not functionally different from format_args!(), it's actually a huge ergonomic benefit to be able to write the arguments interleaved with the string literal text. For example, this allows for writing code that doesn't have SQL injection vulnerabilities that is actually more obvious and readable than code that does have SQL injection vulnerabilities. You've had to tell people why they must not write "SELECT * FROM users WHERE name='"+name+"' AND password='"+password'";", or f"SELECT * FROM users WHERE name='{name}' AND password='{password}';", and have to instead write execute("SELECT * FROM users WHERE name={} AND password={};", name, password), which is harder to read but actually secure. But now they can use t"SELECT * FROM users WHERE name={name} AND password={password};" and the code you can read in order without any extra quotes is actually correct.


to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds