On: Using Clojure for Web Apps

[pinopinopino]

But this looks like a sql injection awaiting to happen:

    (defn inc! [id]
      (kc/exec-raw (format "UPDATE articles SET count = count + 1 WHERE id = %s" id)))

(From https://github.com/tbsschroeder/clojure-webshop-app/blob/mas...) You don't need format it seems: https://github.com/korma/Korma/blob/master/src/korma/core.cl...

[jb1991 → pinopinopino]

sanitizing SQL queries is just as simple in Clojure as in any other language (maybe more so), even if it wasn't done in this example.

[pinopinopino → jb1991]

It looks like it is builtin even in the library he uses. So not sure why he chooses format.