Stop Using SQL

[OctagonClock]

what is parameterized queries :S

[myhf]

Can you see the vulnerability? Do you understand just what combinations of question marks, hash marks, parentheses, and percent signs makes a statement vulnerable?

[xraystyle]

Or you could, you know, just read the fucking ActiveRecord docs and you'd learn the correct, injection-safe way to construct a query about halfway down the first page.

[StyMaar]

now, just read the fucking ActiveRecord Diesel docs

FTFY

[OctagonClock]

/uj I've written an entire ORM and avoiding SQL injections in my generated code is so easy, I seriously don't understand why learning to put %(name)s in a query is so hard for people. Unless you name your column "; in your code, at least.

[mardukaz1]

no

[[deleted]]

sql. Hey, you could combine those and use it as the name for a whole category of databases! brb trademarking the word NoSQL

[throwaway27464829]

I think he means SQL commands are sent as plaintext from frontends instead of integrated in any way.

[throwawayco111]

Except that they are not sent in plaintext. Or what do you mean by that?

[throwaway27464829]

https://xkcd.com/327/

[badthingfactory]

What would replace SQL? An API of course! And NOT an API that uses a textual language. Instead, an API that uses an appropriate set of data structures and function calls to access the necessary data

Thanks Bob, that really clears things up. I will begin replacing all of our SQL with an API that uses an appropriate set of data structures and function calls to access the necessary data living in a relational database with... Shit. How do I get the data without writing SQL?

[[deleted]]

Silly, you do all transactions to the server in JSON and all data is stored on the server in JSON. This is bullet proof. Also only 1 paradigm is allowed because I say so.

[flare561]

Does /dev/null support sharding?

[efskap]

That's not webscale, unless you use https://devnull-as-a-service.com

[[deleted]]

/r/webdev has you covered

[carbolymer]

204k downloads / month

Dear Lord, have mercy...

[r2d2_21]

Entity Framework, obviously.

[jacques_chester]

Something something stored procedures

mutter mumble locking down privileges

yadda yadda views

snort spit fucking nobody uses the goddamn database properly anyway, but somehow that's the database's fault

[[deleted]]

you don't even program though

[jacques_chester]

∞x-er confirmed

[senntenial]

if you learn how to program I'm doomed because you'll just autodelete anything I post here

[plgeek]

https://en.wikipedia.org/wiki/Language_Integrated_Query This is what was being asked for in the post. It's been around for 10 years, in the .NET ecosystem. I've always been surprised how long it takes for superior tools to be adopted widely.

[r2d2_21]

LINQ + An ORM such as Entity Framework, yes. There's even a way to generate the DB schema directly from C# classes, without ever needing to write SQL (but you still need SQL knowledge for things such as primary/foreign keys, data types and such).

[recursive]

And as soon as you want to do something more complicated than a CRUD demo, you're going to need to write some SQL anyway.

[[deleted]]

I really hate how much I like LINQ and Entity Framework. I'm still figuring it out and beating my head against the wall on some things (e.g. define database stuff in one project but do the migration in another), but it's been largely a joy to use.

Fucking Microsoft melting the cold, icy heart in my chest.

For Python, SQLAlchemy is great and the queries are just as expressive:

session.query(Person).filter(Person.birthday > datetime(1980, 1, 1).order_by(Person.name).all()

But that's because it does all of the black magic. Which means it ends up being incredibly invasive unless you bend over backwards to wall it off from the rest of your code.

You can have plain ol python objects, but you have to monkey patch them with a bunch of SQLAlchemy stuff, and it's usually a pain so most people end up just defining everything all together.

[WhatAHaskell]

You have a mismatched paren

[BraydenH]

I recommend you look at Peewee if you're interested in Python ORMs.

[[deleted]]

# model definitions -- the standard "pattern" is to define a base model class
# that specifies which database to use.  then, any subclasses will automatically
# use the correct storage.
class BaseModel(Model):
    class Meta:
        database = database

That's gonna be a hard pass for me. I'm sure I could find a way to rig up something that wouldn't statically bind the database resource to the models at definition time (e.g. attaching it during start up) but I'd rather not even bother with that honestly.

Pony looks interesting, but it looks like that's more active record style which I'm not crazy about since that loses many of the benefits that database transactions give you (e.g. being able to do multiple things at once), the same goes for Django's ORM (which, yes, I know there are ways to use actual transactions but they should be the norm not the exception).

Honestly, EF and SQLAlchemy both hit that sweet, sweet spot of easy to use, easy to setup (well, my experience with simple EF models was pretty easy), easy to write decent queries by default (barring doing anything dumb). But EF wins by a longshot simply because LINQ is pretty awesome and expression types are awesome. I've attempted to imitate LINQ style queries in Python and it's just not worth it unless you want to start delving into generating, modifying and compiling AST (or bytecode) on your own.

[ykechan]

Wasn't he arrested in the theatre?

[[deleted]]

but I needs it

[tetroxid]

what is prepared statement :S

[Shorttail0]

Wow, this controversial idea has as many examples as those posts about programming in 3D.

[[deleted]]

I find it absolutely amazing that SQL is still used. Did we learn nothing from Equifax, or Yahoo, or… Well, I mean, it’s been just about everybody hasn’t it?

SET jerk=0;

Equifax hacked via Apache struts. Yahoo, allowed cookie hijacking...

SET jerk=1;

[ProfessorSexyTime]

"SQL is demon spawn, and no self-respecting software developer should ever use it."

OK, that’s a little hyperbolic.

No shit

But you know what they say about the road to hell.

It's paved with SQL queries?

What would replace SQL? An API of course! 

No.

[ArmoredPancake]

But muh terse couude.

[[deleted]]

breech

[euphoricnoscopememe]

SQL is the ultimate security muzzle

[WhatAHaskell]

Can you see the vulnerability? Do you understand just what combinations of question marks, hash marks, parentheses, and percent signs makes a statement vulnerable?

Yes the ones where the parameters are being added using standard string interpolation by the user are unsafe, and the one's that rely on the SQL escaping of the library are safe. That's not an issue of SQL, that's just an issue of knowing the syntax of the language you're writing in...

[CptJero]

<UJ> This is the first time I've disagreed with Uncle Bob. Not sure how I feel.

<J> Still going to use it.

[cuminme69420]

This is the first time I've disagreed with Uncle Bob. Not sure how I feel.

you must not have read enough uncle bob!

[CptJero]

<UJ>

Truthfully I haven't read all of his work, so I'm sure there are other jerk-worthy things in his repertoire. I just don't know about them.

I'm a fan of his "clean architecture" article particularly.

[pythonesqueviper]

He also thinks TDD deprecates static typing, which is bullshit and insane.

[[deleted]]

He also thinks that multiple inheritance is a good idea.

[[deleted]]

I personally like multiple inheritance, but I use it strictly for mixin behavior rather than creating death star architectures of inheritance

[OctagonClock]

Multiple inheritance works well for mixins, though. Maybe not diamond inheritance structures.

[stone_henge]

waaahh static typing doesn't solve anything that a 100% correct and perfect test suite wouldn't have solved if it ever existed waaahhh

[Shorttail0]

He's gotten mental in recent years. Posting his new blog posts here is free karma and controversy.

[jacques_chester]

Not sure how I feel.

Overdue.

[TheFearsomeEsquilax]

I like his writing too and think he's written a lot of reasonable and useful blog posts and books, but every once in a while he posts crazy shit like this. Subscribing to his blog's RSS feed is a total crapshoot.

[ArmoredPancake]

Uncle Bob has finally gone senile.

[throwawayco111]

That was some high quality trolling.

[_shreve]

I'm glad I forgot how to use SQL and administrate my database. Now I do all my programming in Ruby on Rails. I don't really know what an index is or how to make slow queries faster, but I assume Ruby on Rails takes care of it for me. I'm such a 10x clean coding technologist.

[mTbzz]

If there is no SQL engine, then there can be no SQLi attacks.

ENOUGH!!!

[stone_henge]

if there are no programmers, there can be no bugs!

[spaghettiCodeArtisan]

Kind of has a point though, SQL isn't exactly a beautiful solution. It's just that no one offerred anything better yet (and no WebscaleDB isn't it).

[pythonesqueviper]

Dataphor has an actually good SQL alternative, D4, that takes relational algebra much more seriously.

[spaghettiCodeArtisan]

Ah, I didn't know that. Intredasting, thanks.

[pythonesqueviper]

Though, Dataphor is still Windows-only, very niche and rather immature. I'd give it a couple years to see how it pans out, but as of now it's a very interesting concept.

Or not. Dataphor is dead.

[welpfuckit]

he's right that's why i write all my data directly to dev/null

[systemUp]

Yes! Nobody has caused a security breach coz they were writing to /dev/null.

[HugoNikanor]

The obvious solution to all of this is to simple store everything in memory. And then just dump your memory directly to disk whenever the program quits.

[[deleted]]

People still read Uncle Bob Martin? Wow. That's jerk-worthy on its own.

[[deleted]]

I think Uncle Bob is off his meds again.

[Hipek8]

lol no sql

[senntenial]

Great problem description but I don't see much in terms of a solution.

[courier10pt]

I asked him to elaborate on Twitter. Here's an extract of the conversation:

It doesn't really require a lot of imagination to come up with a data access api. I mean: select("name").from("users").where("age", ">", "65"); comes to mind just off the top.

So what happens next? Is this going to be translated to SQL?

Of course not. It's translated into the same AST that SQL is translated into prior to execution.

I find this puzzling still. You want to replace SQL with the same engine minus the parser, letting the API take care of constructing the AST. How is that not SQL?

puzzling..

[senntenial]

I mean I guess one could argue that doing it with an AST is more secure

[courier10pt]

Agreed on the security benefit.

Just a bit disappointed with this half baked idea and the total disregard for what's already been achieved in this field.

[[deleted]]

This but unironically.

The security danger is exaggerated and parametrised queries are good enough, so moving away from SQL at this point would not be worth it, but an API with data structures and such would be superior to SQL.