Proposal Details

there has been an article about google's efforts to move to secure-by-design languages and libraries. one of the points it raises is about the query API being happy to accept strings (and, consequently, string interpolation).

the simplest solution is to make it use bundled resources instead. this means the package would include static assets consisting of sql script/query files, and the query API would take a reference to them. importantly, this outright forbids string interpolation.