Sqlx: best practices to avoid injection?

[CameronNemo]

Would be great to point out how to avoid injection and what some of the best practices are when handling untrusted input. I know there is not a lot of docs, but if you are looking to add some I think that topic would be well worth it.

[abonander]

Don't do anything that looks like this:

sqlx::query(&format!("select * from my_table where some_column = {}", unsanitized_user_input)).fetch(conn)

Do this instead:

sqlx::query("select * from my_table where some_column = ?")
    .bind(unsanitized_user_input)
    .fetch(conn)
// OR
sqlx::query!("select * from my_table where some_column = ?", unsanitized_user_input)
    .fetch(conn)

It's that easy, seriously. The API was deliberately designed to make injection-vulnerable code very ugly and easy to spot, and correct code very clean and easy to write.

We could probably stand to add warnings about not doing the former, but that's about it otherwise. The database engine handles the rest; in the second example it knows never to treat untrusted_user_input as SQL.