A scalar expression: a column name, or one of the expression helpers.
A bare string is treated as a column name and quoted as an identifier.
That is the safe reading — a string that was meant as SQL would otherwise be
an injection point in exactly the APIs this module exists to protect. Use
literalExpr() to state that a string really is SQL.
A scalar expression: a column name, or one of the expression helpers.
A bare string is treated as a column name and quoted as an identifier. That is the safe reading — a string that was meant as SQL would otherwise be an injection point in exactly the APIs this module exists to protect. Use
literalExpr()to state that a string really is SQL.